Medizin
Monthly
Local file inclusion in the ThemeMove Medizin WordPress theme (all versions before 1.9.7) allows unauthenticated remote attackers to steer a filename/path value into a PHP include/require statement, exposing local files and potentially enabling code execution if the attacker can influence an includable file or an enabled PHP wrapper. The CVSS 3.1 vector is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): exploitation is network-reachable and requires no authentication or user interaction, but the high attack complexity reflects that the exact vulnerable parameter/endpoint is not publicly documented and success depends on prerequisites such as a reachable injection point or an enabled wrapper. No public exploit has been identified at time of analysis, EPSS is low at 0.53% (43rd percentile), and there is no CISA KEV listing, making this a genuine but mid-tier priority for sites running the theme actively.
Local file inclusion in the ThemeMove Medizin WordPress theme (all versions before 1.9.7) allows unauthenticated remote attackers to steer a filename/path value into a PHP include/require statement, exposing local files and potentially enabling code execution if the attacker can influence an includable file or an enabled PHP wrapper. The CVSS 3.1 vector is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): exploitation is network-reachable and requires no authentication or user interaction, but the high attack complexity reflects that the exact vulnerable parameter/endpoint is not publicly documented and success depends on prerequisites such as a reachable injection point or an enabled wrapper. No public exploit has been identified at time of analysis, EPSS is low at 0.53% (43rd percentile), and there is no CISA KEV listing, making this a genuine but mid-tier priority for sites running the theme actively.