Cardea
Monthly
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.