Backhoe
Monthly
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.