Ozeum
Monthly
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.