Biolife WordPress Theme EUVD-2026-96499

Affects sites running the Biolife WordPress theme at version 3.2.3 or earlier. Exploitation is unauthenticated and remote (PR:N/UI:N), but the vendor's AC:H rating indicates success is not guaranteed on a single attempt and depends on conditions the attacker does not fully control - the description does not name the exact vulnerable parameter, required encoding, or configuration, so the precise trigger is unconfirmed from available data. The primary realistic impact is disclosure of local files (e.g., configuration or credential files); escalation to code execution is possible for CWE-98 but not established here. The main limiting factor is that only Biolife-theme installations at or below 3.2.3 are affected, a niche footprint, and the high complexity reduces reliable mass exploitation.

This is a genuine but second-tier priority. The supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) describes a network-reachable, unauthenticated flaw (PR:N) in a WordPress theme, which raises its theoretical reach - but the high attack complexity (AC:H) materially tempers that, implying exploitation depends on conditions outside the attacker's direct control rather than being a trivial one-shot request. Only one intelligence source (Patchstack) is present. No EPSS score, no CISA KEV listing, and no public POC are indicated in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signal rests entirely on the vendor-assigned CVSS. The I:H/A:H ratings are also questionable for a vulnerability titled 'Local File Inclusion' (CWE-98): LFI is primarily a confidentiality issue, and integrity/availability impact would only materialize if the inclusion can be escalated to code execution (e.g., log poisoning or inclusion of attacker-controlled uploads) - this is plausible for CWE-98 but is not stated in the description, so treat I:H/A:H as unverified. Net: a real vulnerability worth patching, but the AC:H gating plus absence of EPSS/KEV/POC signals suggests it is not a mass-exploitation emergency.

A remote attacker sends a crafted request to a vulnerable parameter in a site running the Biolife theme (<= 3.2.3), causing the PHP application to include a local file path chosen by the attacker and return its contents (e.g., wp-config.php or other sensitive files). No authentication is required (PR:N), but the high attack complexity means success likely depends on specific conditions such as particular encoding, configuration, or a reachable file path. No public exploit code is identified at time of analysis.