Armania Theme EUVD-2026-96495

Exploitation targets WordPress sites running the Armania theme at version 1.4.8 or earlier; the attacker reaches a theme code path that passes attacker-influenced input into a PHP include/require (CWE-98) with no authentication (PR:N) and no user interaction (UI:N). The limiting factor is the vendor's AC:H rating: a non-trivial precondition must be satisfied for reliable exploitation (the exact required parameter, path format, or configuration is not detailed in the available data and should be verified against the Patchstack advisory). The site must actually have the Armania theme installed and active, which bounds the exposed population.

The vendor (Patchstack) CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1) describes a network-reachable, unauthenticated (PR:N) flaw requiring no user interaction but with high attack complexity (AC:H), yielding high confidentiality, integrity, and availability impact. The high complexity rating is the key tempering signal: it implies the attacker must satisfy some non-trivial precondition (e.g. a specific request/path structure or race), which lowers real-world exploitability relative to the raw 8.1 score. No EPSS score, no CISA KEV listing, and no public POC were supplied in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no evidence of active or at-scale exploitation. CWE-98 (improper control of filename for include/require in PHP) and the 'LFI'/'Information Disclosure' tags indicate the primary demonstrated impact is arbitrary local file reads; the vendor's I:H/A:H ratings suggest they judge the file inclusion can be escalated to code execution (e.g. via PHP wrappers or log poisoning), but the input does not confirm an RCE technique, so treat I:H/A:H as a vendor assessment rather than independently verified. Net: a genuinely serious unauthenticated flaw in the affected theme, but AC:H plus absence of KEV/POC/EPSS signals place it below drop-everything priority for most environments - patch promptly where Armania is deployed, but it is not evidence of mass exploitation.

A remote attacker who does not need credentials sends a crafted request to a WordPress site running the Armania theme (<= 1.4.8), manipulating a parameter that controls a PHP include/require path to pull in an attacker-chosen local file. This can disclose sensitive files such as wp-config.php (database credentials, auth keys), and - if the inclusion path can reach attacker-controlled content - potentially escalate to code execution. No public exploit code was identified in the provided data, and the high attack complexity means a non-trivial precondition must be met.