Flipmart WordPress Theme EUVD-2026-96485

Exploitation requires reaching the Flipmart theme's vulnerable file-inclusion code path with attacker-controlled input that is passed into a PHP include/require (CWE-98), on a WordPress site running the Flipmart theme at version 2.8 or earlier. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the CVSS AC:H rating indicates meaningful limiting factors - exploitation likely depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration (e.g., allow_url_include, readable target files) rather than succeeding against every deployment on a first attempt. Escalation beyond file disclosure to code execution depends on the presence of includable attacker-influenced content (logs, uploads, wrappers). The exact vulnerable parameter/endpoint is not specified in the available data.

This is a serious but not top-tier-emergency issue. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 High) shows a network-reachable, unauthenticated flaw (PR:N) requiring no user interaction, which raises its priority. The mitigating signal is AC:H - high attack complexity - indicating exploitation is not fully trivial and likely depends on specific conditions, encoding, or timing. No EPSS probability, no CISA KEV listing, and no public POC are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the AC:H rating alone lowers the odds of mass, commoditized scanning versus a PR:N/AC:L bug. Note a signal tension worth verifying: the input vector asserts full C:H/I:H/A:H, but the vulnerability is described as 'Local File Inclusion' and tagged 'Information Disclosure,' which typically maps to a confidentiality-dominant impact - the claimed integrity/availability impact likely reflects CWE-98's potential to escalate LFI into code execution (e.g., log/wrapper/uploaded-file inclusion) rather than confirmed I/A loss; confirm the real impact ceiling with Patchstack. Net: a real patch-worthy priority for any site running the Flipmart theme, but the absence of KEV/EPSS/POC and the AC:H gate argue against treating it as an immediate wormable emergency.

A remote attacker, without any credentials, sends a crafted HTTP request to a vulnerable Flipmart theme endpoint that passes attacker-controlled input into a PHP file-inclusion call, causing the server to read and return a sensitive local file (such as wp-config.php) or, if conditions allow inclusion of attacker-influenced content, to execute PHP. The AC:H rating means the request likely needs specific parameters, path traversal/encoding, or a particular configuration to succeed. No public exploit code is identified at time of analysis.