Cardea WordPress Theme EUVD-2026-96480

Exploitation targets the file-inclusion logic of the CocoBasic Cardea WordPress theme on sites running version 2.3 or earlier; no authentication is required (PR:N) and no user interaction is needed (UI:N). The key LIMITING factor is the CVSS high attack complexity (AC:H): the advisory implies a non-trivial precondition or attacker-uncontrollable circumstance (such as a specific request/path condition or configuration state) that is not spelled out in the single Patchstack reference, so reliable exploitation is not guaranteed against every default install. Risk is further bounded by the requirement that the Cardea theme specifically be installed and active, which is uncommon outside the theme's limited user base.

This is a moderate-priority issue rather than an emergency, and several signals must be weighed against each other. The CVSS 3.1 base score of 8.1 is driven by network vector (AV:N), no privileges (PR:N), and full CIA impact (C:H/I:H/A:H), consistent with CWE-98 (improper control of filename for include/require), which spans both local file inclusion and remote file inclusion that can escalate to code execution. However, the vector explicitly assigns high attack complexity (AC:H), which materially lowers real-world exploitability versus a typical AV:N/AC:L flaw - it signals a precondition or non-trivial step the attacker does not fully control. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public exploit is referenced; therefore this is 'no public exploit identified at time of analysis.' The target is the CocoBasic 'Cardea' WordPress theme (versions <= 2.3), a commercial theme with a narrow deployment footprint, so even a high-severity flaw affects a small population. Net: treat as a prioritized patch for any site actually running Cardea, but it does not warrant the same urgency as a broadly-deployed, low-complexity, actively-exploited vulnerability. No conflicting data between vector and description was found, but the AC:H precondition is undocumented in the terse advisory and should be confirmed with Patchstack/vendor.

A remote, unauthenticated attacker crafts a request to a vulnerable file-inclusion entry point in the Cardea theme and manipulates a path/filename parameter to load an attacker-chosen file. Because CWE-98 covers remote file inclusion, a successful chain could move from reading sensitive local files (e.g., wp-config.php) to executing PHP, explaining the I:H/A:H rating; the AC:H metric indicates this requires a non-default precondition or a reliability hurdle the attacker must overcome. No public proof-of-concept is referenced, so exploitation is currently theoretical based on the advisory.