Volos WordPress Theme EUVD-2026-96481

The vulnerable input is a local-file-inclusion sink in the Volos WordPress theme at versions 1.2 and below (PHP include/require with attacker-controlled path, per CWE-98); the specific parameter and endpoint are not disclosed in the available data. No authentication is required (PR:N) and no user interaction (UI:N), making it remotely reachable against any site with the affected theme active. The key limiting factor is the high attack complexity (AC:H), indicating a non-trivial precondition - such as a specific configuration, path, timing/race, or environmental state - must be met for reliable exploitation; additionally, exploitation is scoped to sites actually running the Volos theme ≤1.2, a narrow installed base.

The input CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated (PR:N) flaw requiring no user interaction but carrying high attack complexity (AC:H), which materially tempers the raw score - successful exploitation likely depends on a specific condition or timing rather than being trivially repeatable. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is currently no public exploit identified at time of analysis and no evidence of active exploitation; the risk signals are therefore limited to the theoretical CVSS rating. CWE-98 (PHP file inclusion) legitimately justifies the C:H rating and can plausibly escalate to code execution via PHP wrappers or log poisoning, supporting the I:H/A:H impacts, though the vendor description characterizes the issue narrowly as 'Local File Inclusion' and the tags emphasize 'Information Disclosure', which suggests file-read impact is the confirmed primary effect while full integrity/availability impact is inferred from the CWE class rather than stated. Net assessment: a genuinely serious flaw for any site running the affected theme, but the combination of AC:H, no observed exploitation, and the niche footprint of a single WordPress theme places it below internet-wide emergencies - prioritize patching for affected installations but it is not a mass-exploitation priority on current evidence.

A remote, unauthenticated attacker sends a crafted request to a Volos-theme endpoint that passes attacker-controlled input into a PHP include/require path, causing the application to read or include an arbitrary local file (e.g., wp-config.php). Because the CVSS specifies AC:H, the attacker may need to satisfy a specific precondition or win a race before the inclusion succeeds. No public proof-of-concept is identified at time of analysis.