Fuelthemes Werkstatt EUVD-2026-95762

Exploitation requires reaching the specific Werkstatt theme code path (within versions up to and including 4.8.3) that passes unsanitized input into a PHP include/require statement; CVSS PR:N/UI:N indicates no authentication or user interaction is needed. However, AC:H signals real limiting factors: successful inclusion likely depends on server configuration (e.g., allow_url_include/PHP settings for any remote-fetch variant, writable or predictable local paths for log/upload poisoning to achieve code execution) and on the attacker controlling a particular request parameter. Pure local file inclusion yields file disclosure; escalation to code execution requires an includable attacker-controlled file on the target. Sites not running the Werkstatt theme, or already updated past 4.8.3, are not affected.

This is a CVSS 8.1 (High) PHP Remote/Local File Inclusion flaw (CWE-98) in the Fuelthemes Werkstatt WordPress theme, versions up to and including 4.8.3. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, unauthenticated vulnerability with full confidentiality, integrity, and availability impact, but notably with HIGH attack complexity (AC:H) - meaning successful exploitation depends on conditions outside the attacker's control, which meaningfully tempers the real-world urgency relative to the raw 8.1 score. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The absence of these signals combined with AC:H suggests this is a genuine but not yet weaponized issue: a real priority for Werkstatt operators to patch, but not an emergency on the level of a low-complexity, actively-exploited bug. Note a classification tension: the title references 'PHP Remote File Inclusion' (CWE-98) while the description states it 'allows PHP Local File Inclusion' - the practical exploitation path appears to be LFI, which can still escalate to code execution via techniques like log poisoning or inclusion of attacker-controlled uploads, justifying the full I/A impact. The single reference is a Patchstack advisory; no independent vendor advisory is in the data.

A remote, unauthenticated attacker crafts an HTTP request to a vulnerable Werkstatt theme endpoint that passes attacker-influenced input into a PHP include/require statement, causing the site to include an arbitrary local file (e.g., a path-traversal to a sensitive config file or a poisoned log/upload). Because exploitation hinges on specific conditions (AC:H) such as a particular parameter or server setup, it is not trivially automatable; no public exploit code is identified at time of analysis.