EUVD-2026-37658Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint WordPress theme as EcoBlue
-
DeliverySend crafted request with traversal payload
-
ExploitTrigger unsanitized include() in theme
-
ExecutionRead wp-config.php or sensitive PHP files
-
PersistHarvest DB credentials and auth keys
-
ImpactEscalate to RCE via log/session poisoning
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Target must be a WordPress site running the ThemeREX EcoBlue theme at version 1.15 or earlier with the vulnerable theme endpoint reachable over HTTP/HTTPS (default for any public WordPress installation using this theme). No authentication, user interaction, or non-default plugin configuration is required per CVSS PR:N/UI:N. Limiting factors: the CVSS AC:H rating indicates the attacker must satisfy a non-obvious precondition - likely knowledge of the specific vulnerable parameter name, a particular request path, or encoding required to bypass partial filtering - and the impact ceiling depends on PHP runtime settings (allow_url_include, open_basedir, file permissions) governing what files can be included and whether code execution is achievable beyond source disclosure. |
| Impact | CVSS 3.1 base score is 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - unauthenticated, network-reachable, no user interaction, full CIA impact, but with high attack complexity. The High AC is unusual for a typical LFI and suggests Patchstack assessed that some non-trivial precondition (specific parameter, configuration, or encoding) is needed. No EPSS score was supplied, the issue is not in CISA KEV, and no public PoC was indexed in the references - so this is no public exploit identified at time of analysis. Real-world risk is moderate-to-high: WordPress themes are widely deployed and indexable by attackers via wpscan-style fingerprinting, but the AC:H rating and lack of observed exploitation argue against treating this as an emergency over confirmed actively-exploited issues. The reference set is thin (a single Patchstack advisory) and the underlying vulnerable parameter is not disclosed publicly, which limits independent verification. |
| Exploit ScenarioDerived | An unauthenticated attacker fingerprints a WordPress site running the EcoBlue theme (visible in HTML source or via /wp-content/themes/ecoblue/), then issues a crafted GET request to a vulnerable theme endpoint with a path-traversal payload such as ?file=../../../../wp-config.php to read database credentials and authentication keys. With those credentials the attacker authenticates to the database or escalates via session/log poisoning to achieve PHP code execution. No public exploit identified at time of analysis, but the WordPress theme attack surface is heavily targeted by automated scanners. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated Local File Inclusion in ThemeREX EcoBlue WordPress theme versions 1.15 and earlier enables remote attackers to include arbitrary local files on the server without credentials, potentially leading to source code disclosure and remote code execution via PHP file inclusion (CWE-98). No public exploit identified at time of analysis, but the unauthenticated network-reachable nature combined with WordPress's broad deployment surface makes this notable. EPSS data was not provided, and the issue is not listed in CISA KEV.
RemediationAI
Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data - administrators should consult the ThemeREX EcoBlue changelog and upgrade to the latest available release beyond 1.15 (verify the fixed version at https://patchstack.com/database/wordpress/theme/ecoblue/vulnerability/wordpress-ecoblue-theme-1-15-local-file-inclusion-vulnerability before deploying). As compensating controls until the patched theme is installed: deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) blocking requests to theme endpoints containing path-traversal sequences such as '../', 'php://', 'file://', or absolute paths in query parameters - side effect is potential false positives on legitimate template parameters. Set PHP open_basedir to restrict include scope to the WordPress directory tree (side effect: may break plugins relying on /tmp or shared libraries), disable allow_url_include in php.ini to prevent remote file inclusion escalation, and restrict filesystem read permissions on sensitive files (wp-config.php, /etc/passwd) where feasible. If the theme is not actively required, switch to a maintained theme as the durable fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
EcoBlue is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:ecoblue). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where a user-controlled value flows into a PHP include/require call without proper sanitization or allowlisting. In WordPress themes this pattern typically appears in template loaders, AJAX handlers, or shortcode rendering endpoints that accept a 'file', 'template', or 'page' parameter and pass it to include() - allowing traversal sequences (../) or absolute paths to load arbitrary .php files from the filesystem. Depending on PHP configuration (allow_url_include, wrappers like php://filter) the flaw can range from source disclosure to RCE via log poisoning or session file inclusion.
Know when Ecoblue gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable theme endpoint, no auth or UI; AC:H reflects non-obvious precondition; full file read (C:H) but integrity/availability impact only via secondary RCE chain (I:L/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.
Executive ViewAI
ThemeREX EcoBlue WordPress theme versions 1.15 and earlier contain an unauthenticated local file inclusion vulnerability (CVSS 8.1) allowing remote attackers to extract sensitive application code and configuration files without credentials. Organizations running WordPress with this theme face immediate risk of information disclosure and potential remote code execution.
No vendor-released patch identified at time of analysis. Implement: (1) Immediate theme deactivation and replacement with alternative-lowest risk option; (2) If retention is required, deploy WAF rules to block LFI attack vectors targeting theme include paths; (3) Restrict file system permissions to prevent PHP execution in theme directories; (4) Enable web server access logging and deploy detection rules for exploitation attempts; (5) Implement file integrity monitoring on application source code and configuration files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB