Struktur (WordPress theme) EUVD-2026-43418

Exploitation requires an authenticated session on the target WordPress site (CVSS PR:L - a valid low-privilege account such as subscriber/contributor) and a request that reaches the theme's parameter-driven PHP include/require path so a local file name can be manipulated via traversal. Limiting factors: the CVSS AC:H rating signals non-trivial, non-default preconditions (the specific vulnerable feature/template path must be reachable and the attacker must craft input that survives partial sanitization), authentication is mandatory (not unauthenticated), and the site must be running the Struktur theme version 2.5.1 or earlier. Because it is classified as Local (not Remote) File Inclusion, only files already present on the server can be included - there is no documented remote-URL inclusion, which further constrains impact absent a secondary log/session-poisoning technique.

The signals are mixed and point to a real-but-conditional risk rather than an urgent internet-wide emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:H = 7.5 High) shows a network-reachable flaw but qualifies it with high attack complexity and a low-privilege authentication requirement, so an attacker needs a valid WordPress account and must satisfy non-default preconditions. No EPSS score, SSVC decision, or KEV entry was provided, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The C:H/I:H/A:H impact rating in the input appears optimistic for a pure LFI classified by its own tags as 'Information Disclosure'; genuine integrity/availability impact would generally depend on a secondary RCE technique (e.g. log or session poisoning) that is not documented here. Net: a legitimate patch-management priority for sites running this theme, but the authentication requirement and high complexity make it more suited to targeted abuse than mass automation.

An attacker registers or acquires a low-privileged WordPress account on a site running Struktur <= 2.5.1, then sends a crafted request to a theme endpoint whose include/require path is influenced by a request parameter, using traversal to point it at wp-config.php or another sensitive server file. The returned or rendered contents leak database credentials and secret keys, which the attacker reuses to deepen access; no public exploit is identified at time of analysis, and the AC:H rating implies the attacker must first satisfy specific preconditions to reach the vulnerable code path.