Shuffle Theme EUVD-2026-65326

The CVSS vector confirms PR:N - no authentication or session is required to send the malicious request. The AC:H designation indicates a specific prerequisite not under the attacker's direct control must be met: a PHP-interpretable file must already exist in a server path reachable by the LFI include directive. In practice, this most commonly means WordPress's media upload functionality must be accessible to untrusted parties (open registration enabled, subscriber-level upload permissions, or a misconfigured form plugin). Without a prior file upload opportunity, exploitation degrades to information disclosure via path traversal (reading wp-config.php, server configuration files, or logs), which remains a serious but lower-severity outcome. Exploitation is limited to WordPress installations running Shuffle theme versions 1.8 and below; sites on a patched version, running a different theme, or without any file upload pathway for unauthenticated/low-privilege users have meaningfully reduced exposure despite the unauthenticated network vector.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields a score of 8.1. The AV:N and PR:N metrics confirm unauthenticated, network-accessible exploitation - the most alarming combination for any internet-facing WordPress deployment. The AC:H designation is the key moderating factor: exploitation is not a single-step operation but requires a precondition outside the attacker's direct control, most commonly that an exploitable file (a PHP payload in an uploaded 'image') already exists in a server path reachable by the include function. No EPSS data was provided, preventing a quantified probability comparison against real-world exploitation rates. No CISA KEV listing is present and no POC has been identified, indicating this has not been widely observed in active campaigns at time of analysis. Absent KEV confirmation, this is best characterized as a high-severity, conditional-exploitation risk: the raw CVSS overstates easy exploitation given AC:H, but the unauthenticated network vector and full CIA impact mean the window of exposure once prerequisites are met is severe. WordPress sites with open user registration, subscriber-level upload permissions, or other untrusted upload paths face materially higher risk.

An unauthenticated attacker enumerates a target WordPress site and confirms the Shuffle theme (≤ 1.8) is active. The attacker exploits a WordPress feature (open registration, guest comments with attachment upload, or a misconfigured upload endpoint) to upload a PHP webshell named shell.php.jpg into wp-content/uploads/. The attacker then sends a crafted HTTP GET or POST request to the vulnerable theme endpoint with a path traversal payload referencing the uploaded file, causing the PHP interpreter to execute the embedded webshell and return a command shell under the web server's UID. No public POC has been identified, but this LFI-to-RCE chain is a canonical technique against WordPress LFI vulnerabilities.