Kaven WordPress Theme EUVD-2026-96482

Exploitable by unauthenticated remote attackers (PR:N, AV:N, UI:N) against WordPress sites running the CocoBasic Kaven theme version 1.2 or earlier. The CVSS AC:H signals a required non-default precondition or non-deterministic element for reliable exploitation that the public advisory does not fully detail (e.g. a specific theme feature/parameter being reachable, particular PHP configuration such as allow_url_include for any remote inclusion, or knowledge of a valid path); this condition is the primary limiting factor and should be confirmed from the Patchstack advisory. The principal limiter beyond CVSS is deployment scope: Kaven is a niche commercial theme, so the exposed population is small relative to core WordPress or popular plugins.

This is a genuinely serious but not emergency-tier vulnerability. The CVSS 8.1 (HIGH) reflects an unauthenticated (PR:N), network-reachable (AV:N) file-inclusion flaw (CWE-98) with full C:H/I:H/A:H impact, meaning successful exploitation can disclose sensitive files and, given CWE-98's file-inclusion nature, potentially escalate to code execution. However, the attack complexity is explicitly High (AC:H), indicating some non-trivial precondition or non-deterministic element that meaningfully lowers the ease of reliable exploitation - this is the main factor separating it from a trivially mass-exploitable bug. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are therefore consistent rather than conflicting: high theoretical impact, but AC:H plus a niche WordPress theme footprint point to opportunistic/targeted rather than widespread automated exploitation. Note that CWE-98 formally describes PHP Remote File Inclusion while the description says 'Local File Inclusion' - a minor framing discrepancy worth verifying against the Patchstack advisory for whether remote URL inclusion (and thus RCE) is actually achievable.

An unauthenticated attacker sends a crafted HTTP request to a WordPress site running the Kaven theme (<= 1.2), manipulating a parameter that is passed into a PHP include/require to point at an attacker-chosen file path. This lets them read sensitive files such as wp-config.php (exposing DB credentials and secret keys), and depending on whether remote/wrapper inclusion is possible under CWE-98, potentially achieve code execution. No public exploit code is identified at this time, and the CVSS AC:H indicates a non-trivial precondition must be met for reliable exploitation.