Volos
Monthly
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.