Wordpress Theme
Monthly
Reflected cross-site scripting via CSRF in the Themefy Bloggie WordPress theme (all versions through 2.0.8) lets a remote attacker execute arbitrary script in a victim's browser session by tricking an authenticated user into clicking a crafted link or visiting a malicious page. Because the CSRF weakness lets the request be forged without a valid anti-CSRF token, no attacker authentication is required, though victim interaction is. There is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.02% (5th percentile).
Server-Side Request Forgery (SSRF) in Jthemes Genemy WordPress theme versions up to 1.6.6 allows unauthenticated remote attackers to make arbitrary HTTP requests from the affected server, potentially accessing internal resources, cloud metadata endpoints, or services restricted to localhost. No CVSS score is assigned in official databases; EPSS probability is extremely low at 0.01%, and no public exploit code or active exploitation has been identified. The vulnerability was reported by Patchstack's security audit team.
Missing authorization in the Vireo WordPress theme (versions up to 1.0.24) enables authenticated attackers with low privileges to bypass access controls and execute high-impact operations including data exfiltration, integrity compromise, and availability disruption. The vulnerability affects a specific WordPress theme product from extendthemes with CVSS 8.8 severity. While EPSS probability is low (0.04%, 13th percentile), the low attack complexity and network attack vector warrant attention for sites using this theme. No public exploit identified at time of analysis, and not listed in CISA KEV.
ColorWay WordPress theme through version 4.2.3 embeds sensitive information in sent data, allowing unauthenticated attackers to retrieve embedded data without authentication. The vulnerability has an exceptionally low exploitation probability (EPSS 0.03%, 9th percentile) despite being information disclosure in nature, suggesting the sensitive data exposure requires specific conditions or limited practical impact. No active exploitation or public exploit code is documented at time of analysis.
Stored cross-site scripting in thinkupthemes Consulting WordPress theme versions through 1.5.0 enables authenticated users or malicious admins to inject persistent JavaScript payloads that execute in the browsers of other site visitors or administrators. The vulnerability allows arbitrary script execution within the context of the affected WordPress installation, potentially leading to account compromise, malware distribution, or session hijacking. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting (XSS) in thinkupthemes Minamaze WordPress theme versions up to 1.10.1 allows authenticated users to inject malicious scripts that persist in the database and execute in the browsers of site visitors. The vulnerability has an EPSS score of 0.01% (3rd percentile), indicating minimal likelihood of exploitation in practice, though it represents a privilege-escalation pathway for authenticated attackers with contributor-level access or higher.
Stored cross-site scripting (XSS) in Shuttle WordPress theme through version 1.5.0 allows authenticated users to inject malicious scripts that persist in the application and execute in the browsers of other users who view the affected content. The vulnerability has an EPSS score of 0.04% (14th percentile), indicating low real-world exploitation probability despite the moderate attack surface typical of stored XSS flaws. No public exploit code or active exploitation has been confirmed.
Stored cross-site scripting (XSS) vulnerability in the Melos WordPress theme through version 1.6.0 allows attackers to inject and execute arbitrary JavaScript code that persists in the application and executes in the browsers of other users. The vulnerability affects all versions up to and including 1.6.0, and while no CVSS vector or EPSS exploitation probability is formally assigned, the low EPSS score (0.04th percentile) suggests minimal real-world exploitation likelihood despite the stored nature of the flaw.
Local file inclusion in the Lekker WordPress theme (all versions through 1.8) by Qodeinteractive allows a remote attacker without authentication to supply a crafted filename parameter that reaches an unsanitized PHP include or require statement, potentially exposing arbitrary server-side files. The CVSS 3.1 vector rates impact as C:H/I:H/A:H, though the primary real-world impact is confidentiality loss through file read (e.g., wp-config.php, .env files containing database credentials). No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.06% (20th percentile), indicating very limited observed exploitation activity.
Insecure Direct Object Reference (IDOR) in the FiveStar WordPress theme allows authenticated low-privilege users to modify or delete arbitrary data due to missing authorization checks on user-controlled keys. Versions up to and including 1.7 are affected, and exploitation can lead to integrity and availability impacts without confidentiality loss. No active exploitation or public exploit is currently identified.
Missing authorization in the Skywarrior Arcane WordPress theme through version 3.6.6 allows unauthenticated remote attackers to exploit improperly configured access controls, resulting in low availability impact. The vulnerability has a CVSS 3.1 base score of 5.3, an EPSS exploitation probability of only 0.04%, and no evidence of active exploitation or public proof-of-concept code.
Insecure direct object references in the Backpack Traveler WordPress theme (versions <= 2.10.3) allow authenticated attackers with low privileges to modify or disrupt resources belonging to other users by manipulating access control keys. The vulnerability does not permit reading of data, only partial integrity and availability impact. EPSS exploitation probability is very low (0.04%) and no active exploitation or public exploit code is confirmed.
Authorization bypass in the Struktur WordPress theme allows authenticated low-privileged users to circumvent intended access controls by manipulating user-controlled keys. Attackers can modify data or cause availability impacts through IDOR on AJAX endpoints, without needing elevated privileges. No active exploitation or public exploit code is confirmed, and the EPSS score suggests very low wild exploitation likelihood.
Unauthorized information disclosure in the Medicalequipment WordPress theme through version 1.0.9 allows unauthenticated remote attackers to access sensitive data due to a missing authorization check. The EPSS exploitation probability is very low (0.04%) and no active exploitation or public proof-of-concept is known, reducing real-world urgency despite a Medium CVSS score.
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.
Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.
Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).
Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Missing Authorization vulnerability in bnayawpguy Resoto resoto allows Exploiting Incorrectly Configured Access Control Security Levels.0.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.
Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.
Missing Authorization vulnerability in Mapro Collins Magazine Edge magazine-edge allows Exploiting Incorrectly Configured Access Control Security Levels.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization controls in Sparkle FSE WordPress theme versions 1.0.9 and earlier allow unauthenticated attackers to bypass access control restrictions and perform unauthorized actions through exploitable endpoint misconfigurations. This authentication bypass vulnerability, reported by Patchstack security researchers, affects all instances of the Sparkle FSE theme up to version 1.0.9 with low exploit probability (EPSS 0.05%) but represents a direct authorization failure (CWE-862) that could enable unauthorized data access or modification depending on endpoint exposure.
Missing authorization controls in sparklewpthemes Construction Light WordPress theme versions 1.6.7 and earlier allow unauthenticated attackers to bypass access restrictions and access resources that should be protected by role-based access control. The vulnerability stems from incorrectly configured access control security levels, potentially exposing sensitive functionality or data to unauthorized users.
Insufficient access control in the ListingPro WordPress theme before version 2.9.10 allows authenticated attackers with low privileges to read high-sensitivity data and modify limited content. The vulnerability has a low EPSS exploitation probability (0.05%) and no public exploit or active exploitation is currently reported.
Local file inclusion in the Traveler WordPress theme prior to version 3.2.6 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure, remote code execution, or full site compromise. Exploitation requires a high-complexity attack with no user interaction, and the EPSS exploitation probability is low (0.08%), with no known public exploitation or active attacks at the time of analysis.
Reflected cross-site scripting vulnerability in the shinetheme Traveler WordPress theme (versions below 3.2.6) enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted link. Successful exploitation could lead to session theft, data compromise, or page manipulation, though no active exploitation or public proof-of-concept is currently known. Upgrading to version 3.2.6 or later resolves the issue.
Blind SQL injection in the Traveler WordPress theme by shinetheme affects versions below 3.2.6, allowing authenticated low-privilege attackers to extract sensitive database information. No public exploit code or active exploitation has been identified at time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Local file inclusion in the TieLabs Jannah WordPress theme up to version 7.6.0 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to sensitive information disclosure (e.g., wp-config.php) or remote code execution via log poisoning. The EPSS score of 0.22% indicates a low probability of imminent exploitation, and no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization checks in the ListingPro WordPress theme (<=2.9.9) enable authenticated users with low privileges to modify data without proper access validation. This broken access control flaw (CWE-862) has a CVSS 6.5 (High integrity impact) and currently no public exploit or active exploitation evidence.
Local file inclusion in Riode WordPress theme versions ≤1.6.23 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem, potentially exposing configuration files, credentials, and source code. The vulnerability stems from improper filename control in PHP include/require statements. Despite the high CVSS score of 8.1, EPSS indicates only 0.06% exploitation probability (18th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Remote code injection in Molla WordPress theme versions ≤1.5.13 allows unauthenticated attackers to inject and execute arbitrary code via unsanitized input in dynamic code contexts. Exploitation has high complexity (CVSS AC:H) and can impact other components due to scope change. No public exploit or active exploitation reported; EPSS 0.07% indicates low real-world risk.
Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Local file inclusion in AncoraThemes Fabrica theme for WordPress <=1.8.1 allows unauthenticated attackers to include and read arbitrary local files on the server, leading to information disclosure and, if chained with techniques like log poisoning or file upload, potential remote code execution. No active exploitation or public exploit has been confirmed; EPSS indicates a low exploitation probability (0.22%).
Unauthenticated remote attackers can exploit a PHP local file inclusion vulnerability in the OnLeash WordPress theme (versions ≤1.5.2) to read sensitive files or achieve remote code execution. No active exploitation or public exploit code has been identified as of this analysis.
Local file inclusion in the MaxCube WordPress theme (versions <= 1.3.1) enables unauthenticated attackers to include arbitrary local files via crafted requests, potentially exposing sensitive data, executing code, and modifying system files. The vulnerability stems from improper validation of filenames in PHP include/require statements. At the time of analysis, no active exploitation or public exploit code is known.
Local file inclusion in AncoraThemes W&D wd theme for WordPress allows unauthenticated attackers to read arbitrary local files and potentially achieve remote code execution. The vulnerability affects versions through 1.0 and has a CVSS 3.1 base score of 8.1, but EPSS predicts a very low exploitation probability (0.08%) with no known public exploits or active exploitation.
Local file inclusion in the Rare Radio WordPress theme (AncoraThemes, versions through 1.0.15.1) exposes WordPress installations to arbitrary PHP file inclusion via unsanitized user input passed to PHP include/require statements. An unauthenticated remote attacker with sufficient complexity can traverse the server filesystem to include PHP files already resident on the server, potentially achieving code execution, credential theft, and full site compromise. No public exploit code or active exploitation has been identified; EPSS is very low at 0.08% (23rd percentile), reflecting limited real-world threat at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
We are tasked with synthesizing data about CVE-2025-60044 into a comprehensive analysis. The input includes: CVE ID, description, CVSS 8.1 with vector, CWE-98, EPSS 0.08%, tags, and a reference to Patchstack. No KEV data, no patch details in the input beyond the description saying "through <= 1.1.0". The description says "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability ... allows PHP Local File Inclusion. This issue affects Fribbo: from n/a through <= 1.1.0." Note: The title says Remote File Inclusion but description says Local File Inclusion. Possibly a misclassification? CWE-98 is "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", which often leads to remote file inclusion if the inclusion is not properly controlled. But the description says PHP Local File Inclusion. We'll handle this. We must output a JSON object with all fields. Let's interpret each: - product_name: "Fribbo" is a WordPress theme. So "Fribbo Theme" or just "Fribbo". Use "Fribbo Theme" maybe. - summary: Original synthesis, not copying description. Start with impact. Impact is local file inclusion (LFI), potentially leading to confidential data exposure, code execution if files are writable, etc. So: "Local file inclusion in the Fribbo WordPress theme (versions <= 1.1.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data or enabling remote code execution if coupled with file upload capabilities." Add that EPSS low, no known exploit, not KEV. - technical_context: PHP Include/Require, CWE-98, improper control of filename. WordPress theme, likely uses include() or require() with user-controllable input without proper sanitization. CPE data not provided explicitly, but we can infer from description: "from n/a through <= 1.1.0". So product is "Fribbo" (WordPress theme). Underlying technology: PHP, WordPress themes. CWE-98 refers to PHP Remote File Inclusion but this is LFI; the vulnerability class is file inclusion. Could be RFI if php:// wrappers are disabled or limited. Discuss the root cause. - risk_assessment: CVSS 8.1, AV:N, AC:H, PR:N, UI:N, S:U, C:H/I:H/A:H. AC:H suggests high attack complexity, perhaps due to specific conditions. EPSS 0.08% (low), no KEV, no POC mentioned. SSVC: not given, but we can reason: exploitation status: no known exploit, automatable? AC:H suggests not easily automatable. Technical impact: high (C/I/A all H). So real-world risk may be lower than CVSS suggests because of complexity and low EPSS. Could be a high CVSS but low real risk because product is not widely deployed? Unknown. State that data missing: no patch version specified, no vendor advisory link beyond Patchstack. Patchstack may have provided patch? Not in data. So "patch status unclear; advisory does not mention a fixed version". Also note that CVSS AC:H and no known public exploit. - affected_products: "Fribbo WordPress theme, versions n/a through 1.1.0. Patchstack advisory: [link]." No CPE string given but NVD might have one. - remediation: Not provided. Suggest upgrade to version beyond 1.1.0 if available. As the advisory doesn't specify a fixed version, "contact vendor or monitor Patchstack for update." Workarounds: Disable theme until patch; restrict file access to prevent sensitive file inclusion; disable dangerous PHP functions (allow_url_include) if not needed. But those are generic. Provide actionable. Since no patch, "No official patch available at this time; consider switching to a different theme, or apply web application firewall rules to block file inclusion attempts." - exploit_scenario: An attacker crafts a request to a vulnerable endpoint that includes a local file via directory traversal, e.g., ?file=../../wp-config.php, leading to disclosure of database credentials. - exploitation_conditions: From description, no explicit conditions, but CVSS vector says no user interaction, no privileges, so likely exploitable remotely without authentication. However, AC:H suggests some complexity, maybe the inclusion path is not directly controllable or requires certain PHP configuration. The description: "Improper Control of Filename for Include/Require Statement" means somewhere user input is used to construct a filename for inclusion. So condition: The theme must be active, and the vulnerable parameter must be present, possibly a specific page or AJAX action. So state: "Requires the Fribbo theme (version <= 1.1.0) to be active. Likely exploitable via an HTTP request to a theme component that accepts a filename parameter. No authentication required. High complexity hints at non-trivial exploitation, possibly due to needing to bypass path restrictions or require specific PHP settings (e.g., allow_url_include off)." - attack_chain: Access: Send crafted HTTP request with file path parameter → Exploit: Bypass filename sanitization (if any) → Include local file → Impact: Read sensitive file, achieve code execution via log poisoning or session file inclusion. But we need a chain in kill-chain phases. Let's do: 5-step: Access → Delivery → Exploit → Execution → Impact. Access: Attacker identifies target WordPress site running vulnerable theme. Delivery: Sends HTTP request to vulnerable theme script. Exploit: Parameter containing path traversal triggers file inclusion. Execution: PHP includes arbitrary local file, potentially leading to code execution if php wrappers used. Impact: Disclosure of sensitive data (wp-config.php) or code execution. So chain: "Identify site with Fribbo theme → Send crafted request with malicious file path → Bypass input sanitization to include local file → Execute included code or retrieve file contents → Extract credentials or compromise server." Alternatively, more concise: "Send HTTP request with ‘file’ parameter containing path traversal → Theme includes arbitrary PHP file → Read sensitive file or execute code." - confidence_notes: "Vulnerability reported by Patchstack, but no fixed version listed. Affected version range confirmed by advisory. No CISA KEV or public exploit. CVSS 8.1 indicates high impact but high complexity; EPSS low, suggesting limited real-world threat." I need to be specific: what's confirmed, inferred, unknown. - prevalence: Fribbo is a niche WordPress theme. Likely low prevalence. I'll go with "low". Prevalence_basis: "niche WordPress theme, presumably limited installation base." - assessed_cvss_vector: The existing vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Let's reassess: Attack vector is network (AV:N) as it's a WordPress theme accessible over the internet. Attack complexity high (AC:H) because exploitation might require specific conditions like certain PHP functions not disabled, or the include path must be constructed precisely. Now, what about impact? LFI can lead to reading arbitrary files, so C:H? If you read wp-config.php, yes, confidentiality high. Integrity high? If you can include a log file with PHP code, you could corrupt log files, but that's often not direct integrity impact. However, LFI can lead to RCE, and RCE can mess with system integrity. The CVSS given has C/I/A all High. Could be too aggressive. If only reading files, only C:H. But description says "file inclusion" which might include ability to include any local file, and if combined with file upload, could include a malicious file. But the base vulnerability only allows including local files that already exist, so integrity and availability impacts are less likely unless you can include a file that performs actions. Conservative: C:H, I:L, A:L? But the CVSS from the reporter is 8.1. I might assess slightly lower. Let's set AV:N, AC:H, PR:N, UI:N, S:U. Impact: C:H, I:L, A:L perhaps, but based on typical LFI, it's often confidentiality only unless there is a way to get code execution. If LFI leads to RCE via PHP wrappers (expect://, data://, etc.), that could give full impact. The description says "PHP Local File Inclusion" not Remote, but with wrappers it could be remote code. So the reporter might be assuming worst case. I'll keep assessed vector as close to theirs but justify if any difference. I'll say "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" but note that AC:H due to requirement that vulnerable parameter exists and PHP configuration might restrict wrappers. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Network-accessible theme with high complexity; full impact if successful, though integrity and availability depend on included file's content." Actually, we can create our own assessment: I'll use AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L, but they gave 8.1 with all High, so I'll stick with the given but acknowledge. I'll set the assessed vector to same as provided, as it's plausible if RCE possible. I'll note in rationale. - assessed_cvss40_vector: Map to 4.0: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Scope unchanged, so subsequent all N. AT:N. Precision rules: Exploitation status: neither KEV nor POC, so "no public exploit identified at time of analysis". Patch status: from the description, "through <= 1.1.0" means version 1.1.0 and below are affected. No fix version given, so "Patch available per vendor advisory" (Patchstack advisory might mention fix? The reference URL is Patchstack, but we don't have content. It says "Patch available" in the input? The input does not say patch available. It just gives a vulnerability report. So we cannot confirm patch. Use: "No vendor-released patch identified at time of analysis" but we only have the advisory from Patchstack, which might have a fix? We don't know. So I'll state: "No patch version confirmed; Patchstack advisory may have update details but not provided." In field, I'll write "Vendor patch status unclear; advisory from Patchstack does not specify a fixed version." So in remediation, advise checking Patchstack. Prevalence: "low" and basis: "obscure WordPress theme". Let's craft each field. product_name: "Fribbo Theme" (1-3 words: "Fribbo" alone is enough? I'll use "Fribbo" as product name, but add Theme for clarity: "Fribbo") summary: "Local file inclusion in Fribbo WordPress theme (<=1.1.0) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive data exposure or code execution if combined with file upload or log manipulation. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability." technical_context: "The vulnerability arises from improper validation of user-supplied input used in PHP include/require statements, classified as CWE-98. The Fribbo theme, likely a commercial or niche WordPress product, fails to sanitize filenames passed to inclusion functions, allowing path traversal sequences. CPE data is not available, but the affected version range is from initial release up to 1.1.0. The underlying technology is PHP running on a WordPress site, where includes are server-side and do not require user interaction." risk_assessment: "CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high impact with complex exploitation. EPSS 0.08% (23rd percentile) suggests very low real-world threat. No CISA KEV or public POC known. The high attack complexity likely stems from the need to bypass any path restrictions or use PHP wrappers that might be disabled. This is a classic high-severity but low-risk scenario for most organizations because of product obscurity and lack of exploits. Missing data: No fix version confirmed; the advisory from Patchstack is the sole source." affected_products: "Fribbo WordPress theme, all versions up to and including 1.1.0. Advisory available at Patchstack (https://patchstack.com/database/Wordpress/Theme/fribbo/vulnerability/wordpress-fribbo-theme-1-1-0-local-file-inclusion-vulnerability?_s_id=cve)." remediation: "No fixed version is listed in the advisory. Users should contact AncoraThemes for a patch or update. As an immediate mitigation, deactivate the Fribbo theme and switch
Local file inclusion in the AncoraThemes Wanderic WordPress theme (versions up to and including 1.0.10) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to full host compromise through information disclosure or remote code execution. Exploitation requires high attack complexity, and no public exploit or confirmed active exploitation has been identified at this time, with EPSS probability at 0.08%.
Local file inclusion in the Chinchilla WordPress theme (version 1.16 and below) allows unauthenticated remote attackers to read arbitrary files on the server, risking information disclosure or remote code execution via log poisoning. The flaw arises from improper filename handling in PHP include/require statements. No public exploit or active exploitation has been identified, and the EPSS percentage remains very low.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.
Local file inclusion in AncoraThemes HealthHub WordPress theme up to version 1.3.0 permits unauthenticated attackers to read arbitrary local files via improper file path handling, potentially enabling remote code execution if a suitable upload or log chain exists. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low (0.08%). The vulnerability carries a CVSS 8.1 base score due to its unauthenticated network vector and high impact, though high attack complexity significantly limits practical exploitation.
Local file inclusion in the Otaku WordPress theme up to version 1.8.0 allows unauthenticated attackers to include arbitrary local PHP files, resulting in information disclosure, credential theft, or remote code execution. Exploitation requires high complexity and no public exploit or active attacks are currently confirmed. The vulnerability affects the AncoraThemes Otaku theme and is tracked as CVE-2025-58896.
Unauthenticated local file inclusion in AncoraThemes Integro WordPress theme ≤1.8.0 allows remote attackers to read arbitrary files on the server or potentially execute code. The vulnerability carries a CVSS 8.1 score but has low exploitation probability (EPSS 0.08%) and no evidence of active exploitation or public exploit code at the time of analysis.
Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.
Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).
Local file inclusion in the Tourimo WordPress theme (<=1.2.3) enables unauthenticated remote attackers to read arbitrary files and potentially execute arbitrary PHP code, leading to full site compromise. This vulnerability, reported by Patchstack, carries a CVSS score of 8.1 but has a low EPSS exploitation probability (0.08%), with no evidence of active exploitation or public exploit code.
Local file inclusion in the AncoraThemes Sanger WordPress theme up to version 1.24.0 allows unauthenticated remote attackers to include arbitrary local files, potentially disclosing sensitive data or executing arbitrary code under specific server conditions. No evidence of active exploitation exists, and the EPSS score of 0.08% indicates low likelihood of widespread attacks.
Local file inclusion vulnerability in the AncoraThemes Playful theme for WordPress up to version 1.19.0 allows unauthenticated attackers
Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.
Local file inclusion in AncoraThemes The Flash theme through version 1.15 enables unauthenticated attackers to read arbitrary files on the server, potentially exposing configuration files and leading to code execution. No public exploit has been identified, and EPSS probability is low (0.08%). The vulnerability is not listed in CISA KEV.
Local file inclusion in AncoraThemes Pathfinder WordPress theme through version 1.16 allows unauthenticated remote attackers to include arbitrary PHP files on the server, potentially leading to complete system compromise via code execution, though high attack complexity and very low exploitation probability (EPSS 0.08%) suggest limited real-world risk without specific server conditions.
Local file inclusion in AncoraThemes Festy theme for WordPress up to 1.13.0 allows unauthenticated remote attackers to read arbitrary files on the server. No known active exploitation, and EPSS indicates low probability (0.08%). Successful exploitation can expose sensitive configuration files but high attack complexity and no public exploit suggest lower immediate risk.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
Local file inclusion in the Hanani WordPress theme (versions up to 1.2.11) allows unauthenticated remote attackers to include arbitrary local files, potentially enabling full server compromise. Exploitation complexity is high, and EPSS indicates very low real-world exploitation probability. No active exploitation or public proof-of-concept is known at this time.
Reflected cross-site scripting via CSRF in the Themefy Bloggie WordPress theme (all versions through 2.0.8) lets a remote attacker execute arbitrary script in a victim's browser session by tricking an authenticated user into clicking a crafted link or visiting a malicious page. Because the CSRF weakness lets the request be forged without a valid anti-CSRF token, no attacker authentication is required, though victim interaction is. There is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.02% (5th percentile).
Server-Side Request Forgery (SSRF) in Jthemes Genemy WordPress theme versions up to 1.6.6 allows unauthenticated remote attackers to make arbitrary HTTP requests from the affected server, potentially accessing internal resources, cloud metadata endpoints, or services restricted to localhost. No CVSS score is assigned in official databases; EPSS probability is extremely low at 0.01%, and no public exploit code or active exploitation has been identified. The vulnerability was reported by Patchstack's security audit team.
Missing authorization in the Vireo WordPress theme (versions up to 1.0.24) enables authenticated attackers with low privileges to bypass access controls and execute high-impact operations including data exfiltration, integrity compromise, and availability disruption. The vulnerability affects a specific WordPress theme product from extendthemes with CVSS 8.8 severity. While EPSS probability is low (0.04%, 13th percentile), the low attack complexity and network attack vector warrant attention for sites using this theme. No public exploit identified at time of analysis, and not listed in CISA KEV.
ColorWay WordPress theme through version 4.2.3 embeds sensitive information in sent data, allowing unauthenticated attackers to retrieve embedded data without authentication. The vulnerability has an exceptionally low exploitation probability (EPSS 0.03%, 9th percentile) despite being information disclosure in nature, suggesting the sensitive data exposure requires specific conditions or limited practical impact. No active exploitation or public exploit code is documented at time of analysis.
Stored cross-site scripting in thinkupthemes Consulting WordPress theme versions through 1.5.0 enables authenticated users or malicious admins to inject persistent JavaScript payloads that execute in the browsers of other site visitors or administrators. The vulnerability allows arbitrary script execution within the context of the affected WordPress installation, potentially leading to account compromise, malware distribution, or session hijacking. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting (XSS) in thinkupthemes Minamaze WordPress theme versions up to 1.10.1 allows authenticated users to inject malicious scripts that persist in the database and execute in the browsers of site visitors. The vulnerability has an EPSS score of 0.01% (3rd percentile), indicating minimal likelihood of exploitation in practice, though it represents a privilege-escalation pathway for authenticated attackers with contributor-level access or higher.
Stored cross-site scripting (XSS) in Shuttle WordPress theme through version 1.5.0 allows authenticated users to inject malicious scripts that persist in the application and execute in the browsers of other users who view the affected content. The vulnerability has an EPSS score of 0.04% (14th percentile), indicating low real-world exploitation probability despite the moderate attack surface typical of stored XSS flaws. No public exploit code or active exploitation has been confirmed.
Stored cross-site scripting (XSS) vulnerability in the Melos WordPress theme through version 1.6.0 allows attackers to inject and execute arbitrary JavaScript code that persists in the application and executes in the browsers of other users. The vulnerability affects all versions up to and including 1.6.0, and while no CVSS vector or EPSS exploitation probability is formally assigned, the low EPSS score (0.04th percentile) suggests minimal real-world exploitation likelihood despite the stored nature of the flaw.
Local file inclusion in the Lekker WordPress theme (all versions through 1.8) by Qodeinteractive allows a remote attacker without authentication to supply a crafted filename parameter that reaches an unsanitized PHP include or require statement, potentially exposing arbitrary server-side files. The CVSS 3.1 vector rates impact as C:H/I:H/A:H, though the primary real-world impact is confidentiality loss through file read (e.g., wp-config.php, .env files containing database credentials). No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.06% (20th percentile), indicating very limited observed exploitation activity.
Insecure Direct Object Reference (IDOR) in the FiveStar WordPress theme allows authenticated low-privilege users to modify or delete arbitrary data due to missing authorization checks on user-controlled keys. Versions up to and including 1.7 are affected, and exploitation can lead to integrity and availability impacts without confidentiality loss. No active exploitation or public exploit is currently identified.
Missing authorization in the Skywarrior Arcane WordPress theme through version 3.6.6 allows unauthenticated remote attackers to exploit improperly configured access controls, resulting in low availability impact. The vulnerability has a CVSS 3.1 base score of 5.3, an EPSS exploitation probability of only 0.04%, and no evidence of active exploitation or public proof-of-concept code.
Insecure direct object references in the Backpack Traveler WordPress theme (versions <= 2.10.3) allow authenticated attackers with low privileges to modify or disrupt resources belonging to other users by manipulating access control keys. The vulnerability does not permit reading of data, only partial integrity and availability impact. EPSS exploitation probability is very low (0.04%) and no active exploitation or public exploit code is confirmed.
Authorization bypass in the Struktur WordPress theme allows authenticated low-privileged users to circumvent intended access controls by manipulating user-controlled keys. Attackers can modify data or cause availability impacts through IDOR on AJAX endpoints, without needing elevated privileges. No active exploitation or public exploit code is confirmed, and the EPSS score suggests very low wild exploitation likelihood.
Unauthorized information disclosure in the Medicalequipment WordPress theme through version 1.0.9 allows unauthenticated remote attackers to access sensitive data due to a missing authorization check. The EPSS exploitation probability is very low (0.04%) and no active exploitation or public proof-of-concept is known, reducing real-world urgency despite a Medium CVSS score.
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.
Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.
Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).
Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Missing Authorization vulnerability in bnayawpguy Resoto resoto allows Exploiting Incorrectly Configured Access Control Security Levels.0.8. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.
Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.
Missing Authorization vulnerability in Mapro Collins Magazine Edge magazine-edge allows Exploiting Incorrectly Configured Access Control Security Levels.13. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization controls in Sparkle FSE WordPress theme versions 1.0.9 and earlier allow unauthenticated attackers to bypass access control restrictions and perform unauthorized actions through exploitable endpoint misconfigurations. This authentication bypass vulnerability, reported by Patchstack security researchers, affects all instances of the Sparkle FSE theme up to version 1.0.9 with low exploit probability (EPSS 0.05%) but represents a direct authorization failure (CWE-862) that could enable unauthorized data access or modification depending on endpoint exposure.
Missing authorization controls in sparklewpthemes Construction Light WordPress theme versions 1.6.7 and earlier allow unauthenticated attackers to bypass access restrictions and access resources that should be protected by role-based access control. The vulnerability stems from incorrectly configured access control security levels, potentially exposing sensitive functionality or data to unauthorized users.
Insufficient access control in the ListingPro WordPress theme before version 2.9.10 allows authenticated attackers with low privileges to read high-sensitivity data and modify limited content. The vulnerability has a low EPSS exploitation probability (0.05%) and no public exploit or active exploitation is currently reported.
Local file inclusion in the Traveler WordPress theme prior to version 3.2.6 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure, remote code execution, or full site compromise. Exploitation requires a high-complexity attack with no user interaction, and the EPSS exploitation probability is low (0.08%), with no known public exploitation or active attacks at the time of analysis.
Reflected cross-site scripting vulnerability in the shinetheme Traveler WordPress theme (versions below 3.2.6) enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a crafted link. Successful exploitation could lead to session theft, data compromise, or page manipulation, though no active exploitation or public proof-of-concept is currently known. Upgrading to version 3.2.6 or later resolves the issue.
Blind SQL injection in the Traveler WordPress theme by shinetheme affects versions below 3.2.6, allowing authenticated low-privilege attackers to extract sensitive database information. No public exploit code or active exploitation has been identified at time of analysis, and EPSS indicates a low exploitation probability (0.05%).
Local file inclusion in the TieLabs Jannah WordPress theme up to version 7.6.0 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to sensitive information disclosure (e.g., wp-config.php) or remote code execution via log poisoning. The EPSS score of 0.22% indicates a low probability of imminent exploitation, and no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization checks in the ListingPro WordPress theme (<=2.9.9) enable authenticated users with low privileges to modify data without proper access validation. This broken access control flaw (CWE-862) has a CVSS 6.5 (High integrity impact) and currently no public exploit or active exploitation evidence.
Local file inclusion in Riode WordPress theme versions ≤1.6.23 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem, potentially exposing configuration files, credentials, and source code. The vulnerability stems from improper filename control in PHP include/require statements. Despite the high CVSS score of 8.1, EPSS indicates only 0.06% exploitation probability (18th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.
Remote code injection in Molla WordPress theme versions ≤1.5.13 allows unauthenticated attackers to inject and execute arbitrary code via unsanitized input in dynamic code contexts. Exploitation has high complexity (CVSS AC:H) and can impact other components due to scope change. No public exploit or active exploitation reported; EPSS 0.07% indicates low real-world risk.
Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Local file inclusion in AncoraThemes Fabrica theme for WordPress <=1.8.1 allows unauthenticated attackers to include and read arbitrary local files on the server, leading to information disclosure and, if chained with techniques like log poisoning or file upload, potential remote code execution. No active exploitation or public exploit has been confirmed; EPSS indicates a low exploitation probability (0.22%).
Unauthenticated remote attackers can exploit a PHP local file inclusion vulnerability in the OnLeash WordPress theme (versions ≤1.5.2) to read sensitive files or achieve remote code execution. No active exploitation or public exploit code has been identified as of this analysis.
Local file inclusion in the MaxCube WordPress theme (versions <= 1.3.1) enables unauthenticated attackers to include arbitrary local files via crafted requests, potentially exposing sensitive data, executing code, and modifying system files. The vulnerability stems from improper validation of filenames in PHP include/require statements. At the time of analysis, no active exploitation or public exploit code is known.
Local file inclusion in AncoraThemes W&D wd theme for WordPress allows unauthenticated attackers to read arbitrary local files and potentially achieve remote code execution. The vulnerability affects versions through 1.0 and has a CVSS 3.1 base score of 8.1, but EPSS predicts a very low exploitation probability (0.08%) with no known public exploits or active exploitation.
Local file inclusion in the Rare Radio WordPress theme (AncoraThemes, versions through 1.0.15.1) exposes WordPress installations to arbitrary PHP file inclusion via unsanitized user input passed to PHP include/require statements. An unauthenticated remote attacker with sufficient complexity can traverse the server filesystem to include PHP files already resident on the server, potentially achieving code execution, credential theft, and full site compromise. No public exploit code or active exploitation has been identified; EPSS is very low at 0.08% (23rd percentile), reflecting limited real-world threat at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
We are tasked with synthesizing data about CVE-2025-60044 into a comprehensive analysis. The input includes: CVE ID, description, CVSS 8.1 with vector, CWE-98, EPSS 0.08%, tags, and a reference to Patchstack. No KEV data, no patch details in the input beyond the description saying "through <= 1.1.0". The description says "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability ... allows PHP Local File Inclusion. This issue affects Fribbo: from n/a through <= 1.1.0." Note: The title says Remote File Inclusion but description says Local File Inclusion. Possibly a misclassification? CWE-98 is "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", which often leads to remote file inclusion if the inclusion is not properly controlled. But the description says PHP Local File Inclusion. We'll handle this. We must output a JSON object with all fields. Let's interpret each: - product_name: "Fribbo" is a WordPress theme. So "Fribbo Theme" or just "Fribbo". Use "Fribbo Theme" maybe. - summary: Original synthesis, not copying description. Start with impact. Impact is local file inclusion (LFI), potentially leading to confidential data exposure, code execution if files are writable, etc. So: "Local file inclusion in the Fribbo WordPress theme (versions <= 1.1.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data or enabling remote code execution if coupled with file upload capabilities." Add that EPSS low, no known exploit, not KEV. - technical_context: PHP Include/Require, CWE-98, improper control of filename. WordPress theme, likely uses include() or require() with user-controllable input without proper sanitization. CPE data not provided explicitly, but we can infer from description: "from n/a through <= 1.1.0". So product is "Fribbo" (WordPress theme). Underlying technology: PHP, WordPress themes. CWE-98 refers to PHP Remote File Inclusion but this is LFI; the vulnerability class is file inclusion. Could be RFI if php:// wrappers are disabled or limited. Discuss the root cause. - risk_assessment: CVSS 8.1, AV:N, AC:H, PR:N, UI:N, S:U, C:H/I:H/A:H. AC:H suggests high attack complexity, perhaps due to specific conditions. EPSS 0.08% (low), no KEV, no POC mentioned. SSVC: not given, but we can reason: exploitation status: no known exploit, automatable? AC:H suggests not easily automatable. Technical impact: high (C/I/A all H). So real-world risk may be lower than CVSS suggests because of complexity and low EPSS. Could be a high CVSS but low real risk because product is not widely deployed? Unknown. State that data missing: no patch version specified, no vendor advisory link beyond Patchstack. Patchstack may have provided patch? Not in data. So "patch status unclear; advisory does not mention a fixed version". Also note that CVSS AC:H and no known public exploit. - affected_products: "Fribbo WordPress theme, versions n/a through 1.1.0. Patchstack advisory: [link]." No CPE string given but NVD might have one. - remediation: Not provided. Suggest upgrade to version beyond 1.1.0 if available. As the advisory doesn't specify a fixed version, "contact vendor or monitor Patchstack for update." Workarounds: Disable theme until patch; restrict file access to prevent sensitive file inclusion; disable dangerous PHP functions (allow_url_include) if not needed. But those are generic. Provide actionable. Since no patch, "No official patch available at this time; consider switching to a different theme, or apply web application firewall rules to block file inclusion attempts." - exploit_scenario: An attacker crafts a request to a vulnerable endpoint that includes a local file via directory traversal, e.g., ?file=../../wp-config.php, leading to disclosure of database credentials. - exploitation_conditions: From description, no explicit conditions, but CVSS vector says no user interaction, no privileges, so likely exploitable remotely without authentication. However, AC:H suggests some complexity, maybe the inclusion path is not directly controllable or requires certain PHP configuration. The description: "Improper Control of Filename for Include/Require Statement" means somewhere user input is used to construct a filename for inclusion. So condition: The theme must be active, and the vulnerable parameter must be present, possibly a specific page or AJAX action. So state: "Requires the Fribbo theme (version <= 1.1.0) to be active. Likely exploitable via an HTTP request to a theme component that accepts a filename parameter. No authentication required. High complexity hints at non-trivial exploitation, possibly due to needing to bypass path restrictions or require specific PHP settings (e.g., allow_url_include off)." - attack_chain: Access: Send crafted HTTP request with file path parameter → Exploit: Bypass filename sanitization (if any) → Include local file → Impact: Read sensitive file, achieve code execution via log poisoning or session file inclusion. But we need a chain in kill-chain phases. Let's do: 5-step: Access → Delivery → Exploit → Execution → Impact. Access: Attacker identifies target WordPress site running vulnerable theme. Delivery: Sends HTTP request to vulnerable theme script. Exploit: Parameter containing path traversal triggers file inclusion. Execution: PHP includes arbitrary local file, potentially leading to code execution if php wrappers used. Impact: Disclosure of sensitive data (wp-config.php) or code execution. So chain: "Identify site with Fribbo theme → Send crafted request with malicious file path → Bypass input sanitization to include local file → Execute included code or retrieve file contents → Extract credentials or compromise server." Alternatively, more concise: "Send HTTP request with ‘file’ parameter containing path traversal → Theme includes arbitrary PHP file → Read sensitive file or execute code." - confidence_notes: "Vulnerability reported by Patchstack, but no fixed version listed. Affected version range confirmed by advisory. No CISA KEV or public exploit. CVSS 8.1 indicates high impact but high complexity; EPSS low, suggesting limited real-world threat." I need to be specific: what's confirmed, inferred, unknown. - prevalence: Fribbo is a niche WordPress theme. Likely low prevalence. I'll go with "low". Prevalence_basis: "niche WordPress theme, presumably limited installation base." - assessed_cvss_vector: The existing vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Let's reassess: Attack vector is network (AV:N) as it's a WordPress theme accessible over the internet. Attack complexity high (AC:H) because exploitation might require specific conditions like certain PHP functions not disabled, or the include path must be constructed precisely. Now, what about impact? LFI can lead to reading arbitrary files, so C:H? If you read wp-config.php, yes, confidentiality high. Integrity high? If you can include a log file with PHP code, you could corrupt log files, but that's often not direct integrity impact. However, LFI can lead to RCE, and RCE can mess with system integrity. The CVSS given has C/I/A all High. Could be too aggressive. If only reading files, only C:H. But description says "file inclusion" which might include ability to include any local file, and if combined with file upload, could include a malicious file. But the base vulnerability only allows including local files that already exist, so integrity and availability impacts are less likely unless you can include a file that performs actions. Conservative: C:H, I:L, A:L? But the CVSS from the reporter is 8.1. I might assess slightly lower. Let's set AV:N, AC:H, PR:N, UI:N, S:U. Impact: C:H, I:L, A:L perhaps, but based on typical LFI, it's often confidentiality only unless there is a way to get code execution. If LFI leads to RCE via PHP wrappers (expect://, data://, etc.), that could give full impact. The description says "PHP Local File Inclusion" not Remote, but with wrappers it could be remote code. So the reporter might be assuming worst case. I'll keep assessed vector as close to theirs but justify if any difference. I'll say "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" but note that AC:H due to requirement that vulnerable parameter exists and PHP configuration might restrict wrappers. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Network-accessible theme with high complexity; full impact if successful, though integrity and availability depend on included file's content." Actually, we can create our own assessment: I'll use AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L, but they gave 8.1 with all High, so I'll stick with the given but acknowledge. I'll set the assessed vector to same as provided, as it's plausible if RCE possible. I'll note in rationale. - assessed_cvss40_vector: Map to 4.0: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Scope unchanged, so subsequent all N. AT:N. Precision rules: Exploitation status: neither KEV nor POC, so "no public exploit identified at time of analysis". Patch status: from the description, "through <= 1.1.0" means version 1.1.0 and below are affected. No fix version given, so "Patch available per vendor advisory" (Patchstack advisory might mention fix? The reference URL is Patchstack, but we don't have content. It says "Patch available" in the input? The input does not say patch available. It just gives a vulnerability report. So we cannot confirm patch. Use: "No vendor-released patch identified at time of analysis" but we only have the advisory from Patchstack, which might have a fix? We don't know. So I'll state: "No patch version confirmed; Patchstack advisory may have update details but not provided." In field, I'll write "Vendor patch status unclear; advisory from Patchstack does not specify a fixed version." So in remediation, advise checking Patchstack. Prevalence: "low" and basis: "obscure WordPress theme". Let's craft each field. product_name: "Fribbo Theme" (1-3 words: "Fribbo" alone is enough? I'll use "Fribbo" as product name, but add Theme for clarity: "Fribbo") summary: "Local file inclusion in Fribbo WordPress theme (<=1.1.0) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive data exposure or code execution if combined with file upload or log manipulation. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability." technical_context: "The vulnerability arises from improper validation of user-supplied input used in PHP include/require statements, classified as CWE-98. The Fribbo theme, likely a commercial or niche WordPress product, fails to sanitize filenames passed to inclusion functions, allowing path traversal sequences. CPE data is not available, but the affected version range is from initial release up to 1.1.0. The underlying technology is PHP running on a WordPress site, where includes are server-side and do not require user interaction." risk_assessment: "CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high impact with complex exploitation. EPSS 0.08% (23rd percentile) suggests very low real-world threat. No CISA KEV or public POC known. The high attack complexity likely stems from the need to bypass any path restrictions or use PHP wrappers that might be disabled. This is a classic high-severity but low-risk scenario for most organizations because of product obscurity and lack of exploits. Missing data: No fix version confirmed; the advisory from Patchstack is the sole source." affected_products: "Fribbo WordPress theme, all versions up to and including 1.1.0. Advisory available at Patchstack (https://patchstack.com/database/Wordpress/Theme/fribbo/vulnerability/wordpress-fribbo-theme-1-1-0-local-file-inclusion-vulnerability?_s_id=cve)." remediation: "No fixed version is listed in the advisory. Users should contact AncoraThemes for a patch or update. As an immediate mitigation, deactivate the Fribbo theme and switch
Local file inclusion in the AncoraThemes Wanderic WordPress theme (versions up to and including 1.0.10) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to full host compromise through information disclosure or remote code execution. Exploitation requires high attack complexity, and no public exploit or confirmed active exploitation has been identified at this time, with EPSS probability at 0.08%.
Local file inclusion in the Chinchilla WordPress theme (version 1.16 and below) allows unauthenticated remote attackers to read arbitrary files on the server, risking information disclosure or remote code execution via log poisoning. The flaw arises from improper filename handling in PHP include/require statements. No public exploit or active exploitation has been identified, and the EPSS percentage remains very low.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.
Local file inclusion in AncoraThemes HealthHub WordPress theme up to version 1.3.0 permits unauthenticated attackers to read arbitrary local files via improper file path handling, potentially enabling remote code execution if a suitable upload or log chain exists. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low (0.08%). The vulnerability carries a CVSS 8.1 base score due to its unauthenticated network vector and high impact, though high attack complexity significantly limits practical exploitation.
Local file inclusion in the Otaku WordPress theme up to version 1.8.0 allows unauthenticated attackers to include arbitrary local PHP files, resulting in information disclosure, credential theft, or remote code execution. Exploitation requires high complexity and no public exploit or active attacks are currently confirmed. The vulnerability affects the AncoraThemes Otaku theme and is tracked as CVE-2025-58896.
Unauthenticated local file inclusion in AncoraThemes Integro WordPress theme ≤1.8.0 allows remote attackers to read arbitrary files on the server or potentially execute code. The vulnerability carries a CVSS 8.1 score but has low exploitation probability (EPSS 0.08%) and no evidence of active exploitation or public exploit code at the time of analysis.
Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.
Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).
Local file inclusion in the Tourimo WordPress theme (<=1.2.3) enables unauthenticated remote attackers to read arbitrary files and potentially execute arbitrary PHP code, leading to full site compromise. This vulnerability, reported by Patchstack, carries a CVSS score of 8.1 but has a low EPSS exploitation probability (0.08%), with no evidence of active exploitation or public exploit code.
Local file inclusion in the AncoraThemes Sanger WordPress theme up to version 1.24.0 allows unauthenticated remote attackers to include arbitrary local files, potentially disclosing sensitive data or executing arbitrary code under specific server conditions. No evidence of active exploitation exists, and the EPSS score of 0.08% indicates low likelihood of widespread attacks.
Local file inclusion vulnerability in the AncoraThemes Playful theme for WordPress up to version 1.19.0 allows unauthenticated attackers
Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.
Local file inclusion in AncoraThemes The Flash theme through version 1.15 enables unauthenticated attackers to read arbitrary files on the server, potentially exposing configuration files and leading to code execution. No public exploit has been identified, and EPSS probability is low (0.08%). The vulnerability is not listed in CISA KEV.
Local file inclusion in AncoraThemes Pathfinder WordPress theme through version 1.16 allows unauthenticated remote attackers to include arbitrary PHP files on the server, potentially leading to complete system compromise via code execution, though high attack complexity and very low exploitation probability (EPSS 0.08%) suggest limited real-world risk without specific server conditions.
Local file inclusion in AncoraThemes Festy theme for WordPress up to 1.13.0 allows unauthenticated remote attackers to read arbitrary files on the server. No known active exploitation, and EPSS indicates low probability (0.08%). Successful exploitation can expose sensitive configuration files but high attack complexity and no public exploit suggest lower immediate risk.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
Local file inclusion in the Hanani WordPress theme (versions up to 1.2.11) allows unauthenticated remote attackers to include arbitrary local files, potentially enabling full server compromise. Exploitation complexity is high, and EPSS indicates very low real-world exploitation probability. No active exploitation or public proof-of-concept is known at this time.