Ozeum WordPress Theme EUVD-2026-96486

Exploitation targets the Ozeum WordPress theme at versions <= 1.3.0 and requires no authentication (PR:N) and no user interaction (UI:N), reachable over the network. However, the advisory does NOT name the specific vulnerable parameter, endpoint, feature, or configuration, and the vendor's HIGH attack complexity (AC:H) indicates that reliable exploitation depends on conditions the attacker does not fully control - for example a specific site/server configuration, non-default state, or a race/timing element - rather than a single trivially repeatable request. The primary limiting factors are therefore the AC:H prerequisite and the narrow affected population (only sites running this particular theme at or below 1.3.0); the exact triggering condition should be confirmed against the Patchstack database entry before assessing realistic risk.

This is a serious-sounding but context-dependent issue. The vendor CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated flaw (PR:N) with no user interaction but HIGH attack complexity (AC:H), which is the single biggest risk-dampening signal here - AC:H means successful exploitation depends on conditions outside the attacker's direct control (timing, specific configuration, or non-default state) rather than a trivially repeatable request. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automated exploitation. There is a notable internal tension in the data: the title and tags label this 'Local File Inclusion' / 'Information Disclosure' (impacts normally confined to confidentiality), yet the vendor assigned I:H and A:H as well - consistent with CWE-98 (improper control of filename for include/require), which can escalate from file read to remote code execution via techniques like PHP wrappers or log poisoning. That I:H/A:H rating should be verified with Patchstack, as it may reflect worst-case RFI-to-RCE potential rather than a demonstrated outcome. Net: treat as a genuine patch priority for anyone running the Ozeum theme (unauthenticated + potential RCE), but the AC:H rating and absence of EPSS/KEV/POC signals argue against emergency, drop-everything urgency compared with a low-complexity, actively-exploited bug.

A remote, unauthenticated attacker sends crafted requests to a WordPress site running the Ozeum theme (<= 1.3.0), abusing a parameter that is passed unsanitized into a PHP include/require to read sensitive local files such as wp-config.php. Because the underlying weakness is CWE-98, the attacker may be able to escalate from file disclosure to code execution if a local file under their influence (e.g., logs or uploads) can be included. No public exploit code is identified at time of analysis, and the high CVSS attack complexity (AC:H) indicates reliable exploitation depends on specific conditions.