Axiomthemes
Monthly
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.
Unauthenticated local file inclusion in the Promo WordPress theme through version 1.3.0 allows remote attackers to coerce the application into including arbitrary PHP files from the server, potentially leading to source code disclosure, sensitive file reads, or remote code execution where attacker-controlled files are reachable. The vulnerability is reported by Patchstack and affects axiomthemes' Promo theme; no public exploit identified at time of analysis and EPSS data was not provided. The CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability despite high attack complexity.
A PHP object injection vulnerability exists in the Axiom Themes m2 | Construction and Tools Store theme through version 1.1.2, stemming from unsafe deserialization of untrusted data (CWE-502). This allows remote attackers to inject malicious serialized objects that can lead to arbitrary code execution or privilege escalation depending on available gadget chains in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, but the vulnerability was reported by Patchstack and affects all installations running the vulnerable theme version.
Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.
Local file inclusion in the Axiomthemes Crafti WordPress theme (versions up to and including 1.12) allows remote unauthenticated attackers to coerce the PHP runtime into including arbitrary local files through improperly validated include/require parameters. Successful exploitation can lead to disclosure of sensitive server-side files, configuration data, and under certain conditions code execution via included content. No public exploit identified at time of analysis, but the issue is catalogued by Patchstack in their WordPress vulnerability database.
Local File Inclusion in Axiomthemes Confidant WordPress theme (versions up to and including 1.4) allows remote unauthenticated attackers to include arbitrary local PHP files on the server, potentially leading to sensitive information disclosure and code execution. The vulnerability is reported by Patchstack with a CVSS 8.1 (High) rating; no public exploit identified at time of analysis and the CVE is not present in CISA KEV. The high attack complexity (AC:H) suggests exploitation requires specific conditions to be met, despite the network-reachable, no-auth attack surface.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.
Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.
Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).
Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis.
Critical deserialization of untrusted data vulnerability in Axiomthemes Sweet Dessert that enables object injection attacks. The vulnerability affects Sweet Dessert versions before 1.1.13 and allows remote attackers to inject malicious serialized objects without authentication, potentially achieving remote code execution with complete system compromise. With a CVSS score of 9.8 and network-based attack vector requiring no user interaction or privileges, this represents a critical internet-exposed risk.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.
Unauthenticated local file inclusion in the Promo WordPress theme through version 1.3.0 allows remote attackers to coerce the application into including arbitrary PHP files from the server, potentially leading to source code disclosure, sensitive file reads, or remote code execution where attacker-controlled files are reachable. The vulnerability is reported by Patchstack and affects axiomthemes' Promo theme; no public exploit identified at time of analysis and EPSS data was not provided. The CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability despite high attack complexity.
A PHP object injection vulnerability exists in the Axiom Themes m2 | Construction and Tools Store theme through version 1.1.2, stemming from unsafe deserialization of untrusted data (CWE-502). This allows remote attackers to inject malicious serialized objects that can lead to arbitrary code execution or privilege escalation depending on available gadget chains in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, but the vulnerability was reported by Patchstack and affects all installations running the vulnerable theme version.
Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.
Local file inclusion in the Axiomthemes Crafti WordPress theme (versions up to and including 1.12) allows remote unauthenticated attackers to coerce the PHP runtime into including arbitrary local files through improperly validated include/require parameters. Successful exploitation can lead to disclosure of sensitive server-side files, configuration data, and under certain conditions code execution via included content. No public exploit identified at time of analysis, but the issue is catalogued by Patchstack in their WordPress vulnerability database.
Local File Inclusion in Axiomthemes Confidant WordPress theme (versions up to and including 1.4) allows remote unauthenticated attackers to include arbitrary local PHP files on the server, potentially leading to sensitive information disclosure and code execution. The vulnerability is reported by Patchstack with a CVSS 8.1 (High) rating; no public exploit identified at time of analysis and the CVE is not present in CISA KEV. The high attack complexity (AC:H) suggests exploitation requires specific conditions to be met, despite the network-reachable, no-auth attack surface.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.
Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.
Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).
Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis.
Critical deserialization of untrusted data vulnerability in Axiomthemes Sweet Dessert that enables object injection attacks. The vulnerability affects Sweet Dessert versions before 1.1.13 and allows remote attackers to inject malicious serialized objects without authentication, potentially achieving remote code execution with complete system compromise. With a CVSS score of 9.8 and network-based attack vector requiring no user interaction or privileges, this represents a critical internet-exposed risk.