Billey
Monthly
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.
Local file inclusion in the ThemeMove Billey WordPress theme (all versions from initial release through 2.1.5) allows unauthenticated remote attackers to pass attacker-influenced input into a PHP include/require statement, enabling disclosure of local files on the web server and, where an includable attacker-controlled file is reachable on the host, escalation to code execution. The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but also a non-trivial precondition that limits reliable exploitation, while EPSS is low at 0.53% (43rd percentile) and no public exploit identified at time of analysis. Sites running Billey 2.1.6 or later are not affected.
Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.
Local file inclusion in the ThemeMove Billey WordPress theme (all versions from initial release through 2.1.5) allows unauthenticated remote attackers to pass attacker-influenced input into a PHP include/require statement, enabling disclosure of local files on the web server and, where an includable attacker-controlled file is reachable on the host, escalation to code execution. The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity and availability impact but also a non-trivial precondition that limits reliable exploitation, while EPSS is low at 0.53% (43rd percentile) and no public exploit identified at time of analysis. Sites running Billey 2.1.6 or later are not affected.