What is the CVSS score of EUVD-2026-57980?

EUVD-2026-57980 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of AI Hub are affected by EUVD-2026-57980?

The AI Hub WordPress theme (versions ≤1.3.10) contains a path traversal vulnerability that allows authenticated subscribers to download arbitrary server files, including database credentials and…

How to fix or mitigate EUVD-2026-57980?

Within 24 hours, identify all WordPress installations using AI Hub theme versions 1.3.10 and earlier; immediately disable public user registration or restrict subscriber role to administrative approval only; and audit web server access logs for unusual file download patterns. Within 7 days, either disable the AI Hub theme entirely or restrict subscriber capabilities to block access to vulnerable functions; rotate all database credentials, API keys, and encryption keys; and review database access logs for unauthorized queries or privilege escalations. Within 30 days, implement Web Application Firewall rules to block path traversal payloads (../ patterns); enforce file system permissions limiting the web server process to only required directories; verify backup integrity from pre-compromise dates; and maintain monitoring for indicators of compromise including unexpected database connections and configuration file access.

AI Hub EUVD-2026-57980

| CVE-2026-65582 HIGH

Path Traversal (CWE-22)

2026-08-13 Patchstack

GHSA-h7c8-vx4q-xf5p

WordPress Path Traversal Ai Hub Wordpress Theme Liquidthemes

7.7

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Subscriber-level auth (PR:L) required; network-exploitable with no complexity; scope changes to server filesystem enabling arbitrary file read (C:H, S:C); no write or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:43 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.7

DescriptionCVE.org

Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.

AnalysisAI

Path traversal exploitation in the AI Hub WordPress theme (versions <= 1.3.10) enables any authenticated subscriber to download arbitrary files from the web server, including sensitive configuration files outside the WordPress document root. With a Changed Scope designation in the CVSS vector, the attacker's reach extends beyond the WordPress application to the underlying server filesystem, enabling theft of database credentials, private keys, and system configuration data. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low privilege requirement - a subscriber account - significantly lowers the bar for abuse on sites with open user registration.

Technical ContextAI

The AI Hub theme (CPE: cpe:2.3:a:liquidthemes:ai_hub:*:*:*:*:*:*:*:*) by Liquidthemes is a WordPress theme that implements a file download feature vulnerable to CWE-22 (Path Traversal). The root cause is insufficient sanitization of user-supplied file path parameters - an attacker can inject directory traversal sequences such as '../../' to escape the intended download directory and access arbitrary files on the server filesystem. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:C reflects that exploitation is network-reachable with low complexity and requires only a subscriber-level WordPress account, while the Changed Scope metric captures that impact extends beyond the WordPress installation boundary to server-level resources.

RemediationAI

Administrators running the AI Hub theme should immediately check for a version beyond 1.3.10 via the WordPress theme updater or the Liquidthemes vendor site; no specific patched release was confirmed in the available data at time of analysis, so consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/aihub/vulnerability/wordpress-ai-hub-theme-1-3-10-arbitrary-file-download-vulnerability for current patch status. As a compensating control while awaiting a confirmed fix, disable WordPress open user registration (Settings > General > uncheck 'Anyone can register') to prevent unauthenticated parties from obtaining subscriber accounts; note this will impact intended functionality on membership or community sites. If the theme's file download endpoint can be identified via code inspection, block it at the web application firewall or server layer for non-administrative roles. Audit all existing subscriber accounts for legitimacy, as any compromised or malicious subscriber account represents an active risk.