What is the CVSS score of EUVD-2026-37649?

EUVD-2026-37649 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Reprizo WordPress Theme are affected by EUVD-2026-37649?

The Reprizo WordPress theme (versions 1.0.8 and earlier) by AxiomThemes contains an unauthenticated file inclusion vulnerability allowing remote attackers to extract database credentials, API keys,…

How to fix or mitigate EUVD-2026-37649?

Within 24 hours: Inventory all web servers running Reprizo WordPress theme v1.0.8 or earlier; immediately deactivate the theme in WordPress admin panel. If the theme's functionality is business-critical, restrict web access via firewall rules pending replacement. Within 7 days: Evaluate and test compatible replacement themes or custom development solutions to restore required functionality without introducing risk. Within 30 days: Complete full migration to secure alternative and conduct forensic review of server access logs during the vulnerable window to identify and investigate any suspicious file inclusion attempts.

Reprizo WordPress Theme EUVD-2026-37649

| CVE-2026-22326 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP WordPress Information Disclosure LFI Reprizo Wordpress Theme Axiomthemes

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H reflects undisclosed non-trivial condition; LFI primarily yields file disclosure (C:H) with only incidental I/A impact absent confirmed RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:36 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.

AnalysisAI

Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.

Technical ContextAI

Reprizo is a commercial WordPress theme distributed by AxiomThemes (CPE cpe:2.3:a:axiomthemes:reprizo). The root cause is CWE-98, improper control of a filename used in a PHP include/require statement - a class of bug where user-controlled input flows into include(), require(), include_once(), or require_once() without adequate sanitization or allow-listing. In WordPress themes this typically manifests in a template-loader, AJAX endpoint, or shortcode handler that takes a 'file', 'template', 'path' or similar parameter from request input and passes it directly to a PHP file-inclusion primitive, allowing path traversal (../) or absolute paths to reach files outside the intended template directory.

RemediationAI

Upgrade the Reprizo theme to a version newer than 1.0.8 once the vendor (AxiomThemes, distributed via ThemeForest and tracked by Patchstack at https://patchstack.com/database/wordpress/theme/reprizo/vulnerability/wordpress-reprizo-theme-1-0-8-local-file-inclusion-vulnerability) publishes a fixed release; the input data does not name an exact fixed version, so no vendor-released patch is independently confirmed at time of analysis. As compensating controls until a patch is verified, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) to block requests containing path-traversal sequences (../, ..%2f, php://, file://, encoded null bytes) against Reprizo theme endpoints, disable or remove the theme on sites that are not actively using it, and restrict PHP open_basedir and disable allow_url_include in php.ini to limit which files an inclusion can reach - note that aggressive WAF rules can break legitimate template handling and open_basedir can interfere with plugins that legitimately read outside the web root.