Teoro
Monthly
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.