Fabius WordPress Theme EUVD-2026-96484

Affects the CocoBasic 'Fabius' WordPress theme, versions 1.0 and earlier; exploitation is unauthenticated (PR:N) and network-reachable (AV:N) against sites running this theme. The flaw is a PHP file-inclusion (CWE-98) where attacker-controlled input reaches an include/require call, so the prerequisite is that the vulnerable theme file/parameter is deployed and web-accessible. LIMITING FACTORS: the CVSS AC:H rating indicates meaningful attack complexity - successful exploitation likely depends on specific request crafting, server configuration (e.g., allow_url_include/wrapper availability for any RCE escalation, or presence of poisonable files for LFI-to-RCE), or non-default conditions not detailed in the advisory; the exact vulnerable parameter and endpoint are not specified in the available data, and the small deployment footprint of this theme further limits realistic targeting.

Signals are mixed and point to moderate, not top-tier, priority. The NVD CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H = 8.1 High) describes a network-reachable, unauthenticated flaw, which raises urgency, but it is tempered by AC:H (high attack complexity), meaning exploitation likely requires specific, non-trivial conditions rather than a trivial one-shot request. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no evidence of active or imminent widespread exploitation - this is a disclosed-and-patched issue, not a confirmed in-the-wild threat. A notable internal tension: the CVSS claims full I:H/A:H impact, yet Patchstack classifies this as 'Information Disclosure / LFI' and the title is 'Local File Inclusion,' which usually implies file READ (confidentiality) rather than integrity/availability compromise - the I:H/A:H ratings appear to assume an LFI-to-RCE escalation path that is not documented in the available data and should be verified with the vendor/Patchstack. Net: treat as a real but lower-urgency patch item, elevated mainly because it is unauthenticated, de-escalated by high complexity, absence of exploitation signals, and the niche footprint of the affected theme.

A remote, unauthenticated attacker crafts HTTP requests against a vulnerable parameter in the CocoBasic Fabius WordPress theme (<= 1.0) that is passed into a PHP include/require call, using path traversal or a PHP wrapper to load an attacker-chosen local file. This could disclose sensitive files such as wp-config.php (database credentials, auth salts), and under CWE-98's typical LFI-to-RCE patterns (e.g., log or session poisoning) may escalate to code execution. No public exploit code is identified at the time of analysis, and the AV:N/AC:H rating indicates the attack is network-based but non-trivial to reliably execute.