Backhoe WordPress Theme EUVD-2026-96487

Requires network access to a WordPress site running the Backhoe theme version 2.0 or earlier, reachable via a request parameter that controls a file path passed to a PHP include/require. The CVSS vector reports PR:N/UI:N (no authentication and no user interaction per supplied data), but AC:H indicates a required condition outside the attacker's control - the specific vulnerable parameter, endpoint, or configuration is not named in the description and must be derived from the Patchstack advisory. Exploitation is limited to installations of this specific, low-popularity theme; sites not using Backhoe or already on a patched release are unaffected.

This is an unauthenticated Local File Inclusion (CWE-98) in the WordPress 'Backhoe' theme (versions <= 2.0), reported by Patchstack. The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) indicates network-reachable, no-authentication, no-user-interaction exploitation, which raises nominal severity. However, the signals conflict in two ways that temper real-world priority: (1) AC:H means the attacker must meet a condition outside their control, reducing reliability of exploitation; and (2) Patchstack tags the issue 'Information Disclosure'/'LFI', which points to a primarily confidentiality impact, yet the supplied vector asserts full I:H and A:H - the integrity/availability claims are not substantiated by the description and should be verified (CWE-98 file inclusion CAN escalate to code execution if attacker-controlled PHP can be included, but nothing here confirms that). No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no public exploit identified at time of analysis. Net: a genuinely interesting unauthenticated flaw, but tempered by AC:H, an obscure affected product, and absence of any exploitation evidence - treat as a patch-soon item rather than an emergency, prioritizing any publicly exposed sites running this specific theme.

A remote, unauthenticated attacker crafts an HTTP request to a vulnerable Backhoe theme endpoint that supplies a file-path parameter, causing the PHP application to include a local file (e.g., wp-config.php or other sensitive files) and disclose its contents. The CVSS AC:H indicates exploitation depends on a condition the attacker does not fully control, so success may require specific deployment circumstances. No public proof-of-concept was provided in the intelligence sources.