Catamaran
Monthly
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).