Local File Inclusion

Unauthenticated local file inclusion in the Mang Board WordPress plugin (all versions through 2.4.3) allows remote attackers to include and execute arbitrary PHP files by supplying a crafted '<mode>_type' parameter (e.g. foo_type) to any publicly reachable page that renders the [mb_board] shortcode. Because no nonce or capability check is enforced on the shortcode render path, the LFI itself is trivially triggered by an unauthenticated POST and can be used to bypass access controls or disclose sensitive data; full code execution is a further step that requires either a standard PHP installation exposing pearcmd.php (which can be abused to write and then include an attacker-controlled payload in a single request) or the ability to upload .php files that are then included, which is why the vendor scored the issue AC:H despite the unauthenticated PR:N vector. The vulnerability is tracked as CWE-98 with a CVSS 3.1 base score of 8.1, reported by Wordfence; no public exploit code identified at time of analysis and the CVE is not listed in CISA KEV, though the low exploitation complexity warrants prompt patching.

Local file inclusion in the LifterLMS WordPress plugin (up to and including 10.3.1) lets an authenticated attacker with Instructor-level access or above include and execute arbitrary files on the server by manipulating the 'template_name' and 'default_path' attributes of the [lifterlms_checkout] shortcode. The flaw causes llms_get_template() to overwrite its own local parameters via extract(), redirecting a PHP include to an attacker-chosen path, which can bypass access controls, expose sensitive data, and potentially achieve code execution where attacker-controlled content has been uploaded under an allowed file extension. There is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) reflects that Instructor+ authentication and, for full RCE, a successful upload are required prerequisites.

Unauthenticated local file inclusion in ShopMagic for WooCommerce (all versions up to and including 4.9.0) allows remote attackers to include and execute arbitrary .php files on a WordPress server by submitting a path payload as the billing first name during WooCommerce guest checkout. The value reaches the plugin's PHP template renderer through the {{ customer.first_name }} placeholder, and the built-in "New Order email with social media profile links" recipe processes that placeholder out of the box, so default configurations are exploitable with no account, cookie, or nonce. CVSS is 8.1 (C:H/I:H/A:H, AC:H); full code execution additionally requires that an attacker-controllable .php file already exist on the server, and no public exploit code was identified at time of analysis. The vendor-released fix is 4.9.1.

Unauthenticated local file inclusion in the BP Profile Search plugin for WordPress (versions up to and including 5.9) lets an attacker force the site to include an arbitrary PHP file by supplying an 'ajax_template' value inside the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory requests. No authentication or special configuration is required, and the plugin performs no basename restriction, whitelist, or path-traversal validation before appending '.php' and passing the value to bp_locate_template(); escalation to full remote code execution is conditional on an includable PHP file already existing on the server (for example via a separate file-upload weakness or default container images such as wordpress:php8), while without such a file the attacker is limited to including existing server-side PHP, which still risks information disclosure and unintended code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1), with the High attack-complexity reflecting the RCE precondition.

Unauthenticated local file inclusion in the Ambient WordPress theme (Elated Themes) at version 1.7 and earlier lets remote attackers coerce the PHP template loader into reading files outside the intended theme path, exposing secrets such as wp-config.php, database credentials, and other server-side data that is echoed back in the response. The vendor vector (AV:N/AC:H/PR:N/UI:N, score 8.1) requires no authentication or user interaction, but the HIGH attack complexity signals a precondition outside the attacker's control must line up for exploitation, so this is not a trivial one-request compromise of every site; our reassessment retains the confidentiality impact while dropping the unconfirmed integrity and availability components. Exposure is limited to WordPress installations running Ambient at 1.7 or below, and no public exploit code has been identified at time of analysis.

Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.

Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.

Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.

Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.

Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.

Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.

Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.

Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.

Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.

Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.

Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.

Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.

Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.

Unauthenticated local file inclusion in the DirectoryPress WordPress plugin (versions up to and including 3.6.27) allows any remote attacker to read arbitrary files on the hosting server, exposing items such as wp-config.php with database credentials and authentication salts. The reporter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a fully remote, unauthenticated, low-complexity attack requiring no user interaction, and the plugin's modest deployment footprint is the main practical limit on exploitation rather than any configuration prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; independent review narrows realistic impact to confidentiality loss (C:H/I:N/A:N), with escalation to code execution dependent on unconfirmed server conditions such as writable log or session files and PHP wrapper availability.

Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.

Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.

Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.

Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).

Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.

Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.

Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.

Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.

Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.

Local file inclusion in the WPCafe restaurant menu, online ordering and table booking plugin for WordPress affects all versions up to and including 3.0.18, allowing an authenticated user with contributor-level privileges or higher to manipulate the template-scope parameter that the plugin passes into a PHP include, causing arbitrary local files on the server to be read or, under the right conditions, executed. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.5) confirms the low-privileged authenticated prerequisite, while the high attack complexity reflects a second precondition: to reach code execution the attacker must also be able to place a .php file on the server for the vulnerable include to pull in, making full RCE conditional rather than guaranteed. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so real-world risk is tempered by the need for a valid contributor account plus a separate file-placement primitive.

Local file inclusion in the SiteOrigin Widgets Bundle WordPress plugin, in all versions up to and including 1.73.2, lets authenticated attackers with contributor-level access or higher (PR:L per the assessed vector) include and execute server-side .php files, bypassing access controls and exposing sensitive data; full attacker-controlled code execution is conditional on also having a way to place a .php file on the server that can then be included. The flaw is reached remotely by POSTing a crafted widgetData payload containing a legacy top-level 'theme' key together with a non-empty 'columns' array to the /wp-json/sowb/v1/widgets/previews REST endpoint, a structure that slips past validation because update_fields() only processes declared form fields. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the low privilege bar (any contributor account) and the fact that the vulnerable endpoint is REST-reachable without UI interaction make this a conditional priority rather than a drop-everything emergency.

Remote code execution in the CartFlows WordPress plugin affects versions 3.2.0 and earlier, allowing an authenticated user with Contributor role or higher to execute arbitrary code on the hosting server. The flaw is a PHP include/require path-control weakness (CWE-98) with a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires a valid low-privileged account but no user interaction. No public exploit was identified at time of analysis, and the practical exposure depends on whether the site grants Contributor access to untrusted users.

Local file inclusion in the Simply Schedule Appointments WordPress plugin (all versions up to and including 1.6.12.27) allows remote attackers to include and execute arbitrary .php files present on the server via the 'ssa_locale' GET parameter, enabling access-control bypass, disclosure of sensitive data, and PHP code execution whenever attacker-controlled .php content can be placed on the host. The published CVSS 3.1 base score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), but our independent assessment rates the vector as PR:N (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), because the locale filter in class-translation.php is registered unconditionally during plugins_loaded and its callback returns the raw 'ssa_locale' parameter without any nonce or capability check, so the subscriber-level authentication requirement in the published vector is not a genuine barrier in practice. High attack complexity reflects the fact that including an already-present .php file yields information disclosure or access-control bypass, while executing attacker-supplied PHP additionally requires an upload feature or writable path that can host a .php file; no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating confirmed active exploitation.

Remote code execution in InvoicePlane builds prior to 1.7.2-rc-1 allows an attacker who already holds InvoicePlane's administrator-controlled file-write capability to plant a malicious PHP file inside the PHP template directory that Mdl_templates automatically scans and trusts. That planted file can then be selected as public_invoice_template, and when any unauthenticated guest renders the corresponding public invoice, the guest View controller includes and executes it with web-server privileges - a CWE-98 PHP file-inclusion flaw with a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation is gated by the need for high-privilege file-write access (PR:H) even though the execution trigger is network-reachable and unauthenticated, and no public exploit code has been identified at time of analysis; the vendor fixes the issue in 1.7.2-rc-1 by replacing filesystem scanning with explicit allowlist constants.

Local file inclusion in the WP Maps (flippercode) plugin for WordPress, affecting all versions up to and including 4.9.8, allows an authenticated attacker holding subscriber-level access or above to supply a crafted 'page' parameter that reaches the plugin's include logic and pulls in arbitrary local PHP files. File disclosure and access-control bypass are achievable against default configurations, but full remote code execution is conditional, requiring the attacker to additionally place or reference an includable .php file on the server (for example through an upload feature). There is no public exploit identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV).

Unauthenticated local file inclusion in the Visual Composer Website Builder plugin for WordPress (all versions up to and including 45.16.0) lets remote attackers supply the vcv-template request parameter to force the server to include and execute files of their choosing. Because the vulnerable code path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), attackers can directly bypass access controls and read sensitive files on the host; full PHP code execution is achievable only where the attacker can also plant an includable file (for example an uploaded image or other supposedly 'safe' file type) on the server. At time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified, though the Wordfence advisory and the plugin's own Trac changeset confirm an upstream fix has been committed.

Unauthenticated remote attackers can manipulate WordPress core's get_page_template() page-template resolution so that it includes a chosen, readable local .php file residing outside the active theme directories; where the required server and active-theme preconditions are both satisfied, that include escalates to remote code execution. The issue carries a CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the high attack complexity reflecting the need for a suitable readable PHP file and matching environment conditions rather than any authentication or user-interaction barrier. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV; on hardened or non-matching configurations the impact degrades to local file inclusion and information disclosure.

Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.0 or earlier can force the plugin's wte_get_template helper, reachable through one of its shortcodes, to include and execute arbitrary server-side .php files, enabling sensitive data disclosure, access-control bypass, or code execution. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as high because full remote code execution is gated on the attacker being able to place an attacker-controlled .php file on the server for inclusion; without that upload primitive, impact is limited to including and executing pre-existing PHP files. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, so exploitation requires an attacker who already holds a legitimate low-privilege account.

Unauthenticated local file inclusion in the HUSKY - Products Filter for WooCommerce Professional WordPress plugin (all versions up to and including 1.4.4) allows any site visitor to pass an attacker-controlled value through the plugin's 'shortcode' parameter and force the server to include and execute arbitrary .php files, enabling access-control bypass, disclosure of sensitive data, and - where an attacker-controllable .php file already exists on the server (upload, log poisoning, or session files) - full remote code execution. The only access control is a nonce check against 'woof_front_nonce', which the plugin emits into inline JavaScript on every front-end page, so the nonce is freely obtainable without authentication; the assessed CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High) with High confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, but the preconditions are met on default configurations of any WooCommerce site running the affected plugin, making this a genuine high-priority issue rather than a high-CVSS paper tiger.

Remote code execution is achievable on Pepperl+Fuchs ICE2/ICE3-series IO-Link Master devices and the Phoenix Contact IOL MA8 via a local file inclusion flaw in the `/index.php/ajax/save_iodd_parameters` AJAX endpoint. An authenticated attacker holding a valid operator-level session cookie can supply a crafted filename parameter that causes the PHP runtime to include and execute an attacker-controlled file, yielding full device compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation requires prior acquisition of operator credentials.

Remote code execution via PHP local file inclusion on Pepperl+Fuchs ICE2/ICE3 series IO-Link Master devices and OEM equivalents (Phoenix Contact, Indu-Sol variants) allows a low-privileged authenticated attacker to execute arbitrary PHP code by supplying a crafted parameter to the /index.php/ajax/get_iodd_port_info endpoint. The vulnerability requires only a valid user session cookie, making it accessible to any account holder on these industrial automation gateways. Three separate CERT VDE advisories (VDE-2026-014, VDE-2026-027, VDE-2026-028) indicate the same vulnerable firmware is shipped under at least three different vendor brands, broadening the affected fleet across OT environments. No public exploit code or active exploitation has been identified at time of analysis.

Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.

Local file inclusion in MaxSite CMS through 109.6 allows unauthenticated remote attackers to execute privileged PHP handler files by supplying base64-encoded path traversal sequences to the ajax and require-maxsite dispatcher endpoints. The encoding technique bypasses the dispatchers' path validation logic, enabling attackers to reach admin-gated handler actions entirely without credentials. A public proof-of-concept exploit was published on 2026-09-08; the vulnerability spans essentially the entire version history of the product (0.78 through 109.6), and no patched release has been confirmed at time of analysis.

Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.

Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.

Local File Inclusion in the Divi Ajax Filter WordPress plugin (all versions through 5.1.2) lets remote unauthenticated attackers include and execute arbitrary .php files on the server via the 'custom_loop_template' parameter. Reported by Wordfence and rated CVSS 9.8, it enables access-control bypass, sensitive-data disclosure, and - where an attacker can plant a .php file (e.g. through an upload) - remote code execution. No public exploit has been identified at time of analysis and the plugin is not in CISA KEV.

Local File Inclusion in Edge-Themes' Shuffle WordPress theme (all versions through 1.8) exposes WordPress installations to unauthenticated remote code execution. An attacker without any credentials can supply a crafted path parameter to the theme's PHP include logic, causing the server to load and execute arbitrary PHP files - including attacker-uploaded content disguised as images. No public exploit has been identified at time of analysis, but the attack pattern (LFI chained with WordPress media uploads) is well-documented in the ecosystem, and the unauthenticated network vector warrants prompt remediation.

Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) enables unauthenticated remote attackers to include and execute arbitrary PHP files on the server. Rooted in CWE-98 (improper PHP include/require path control), the flaw can be chained with file upload functionality - an attacker uploads a PHP-bearing image or other 'safe' file, then triggers the LFI to execute it - yielding full remote code execution, access control bypass, and sensitive data disclosure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Local File Inclusion in the Mane WordPress theme (all versions up to and including 1.7) allows unauthenticated remote attackers to include and execute arbitrary server-side PHP files, with a realistic path to full remote code execution when file upload functionality is accessible. The CVSS 8.1 score with AC:H signals that the most severe impact - arbitrary code execution - depends on a specific precondition, most likely an attacker-controlled file already present on the server filesystem. No public exploit has been identified at time of analysis, though the LFI-to-RCE chain on WordPress is a well-understood and widely practiced attack class.

Local File Inclusion in MagicAI for WordPress (versions up to and including 1.4) allows authenticated subscribers to include arbitrary PHP files from the server's filesystem by manipulating user-controlled input that is passed to a PHP file-inclusion function without adequate path validation. With CVSS 8.8 (High) and network-accessible exploitation requiring only subscriber-level authentication, this flaw grants attackers full confidentiality, integrity, and availability impact over the affected WordPress installation. No public exploit or CISA KEV listing has been identified at time of analysis.

Local File Inclusion in the Måne WordPress theme (versions ≤ 1.7) exposes sites to unauthenticated file inclusion attacks exploitable over the network, classified under CWE-98 (Improper Control of Filename for PHP Include/Require). Attackers can force the theme's PHP code to include arbitrary server-side files, potentially exposing sensitive configuration data or — when chained with a writable server location — achieving remote code execution under the web server's process identity. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, though the vulnerability class is technically well-understood and widely targeted in WordPress ecosystems.

Arbitrary file disclosure in the WP Cafe Pro WordPress plugin (all versions before 3.0.15) lets remote unauthenticated attackers perform Local File Inclusion, reading sensitive server files such as wp-config.php or, in PHP include contexts, potentially executing attacker-controlled code. The flaw is network-reachable with no privileges or user interaction (CVSS 9.8), was reported by Patchstack, and a vendor patch exists in 3.0.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local File Inclusion in the Tonda Core WordPress plugin (all versions prior to 2.6) exposes unauthenticated remote attackers to arbitrary local-file disclosure and, under secondary conditions, potential remote code execution on the host server. Reported by Patchstack and registered under ENISA EUVD-2026-64791, the flaw carries a CVSS 3.1 score of 8.1 with full C/I/A impact and no authentication requirement. A vendor-released patch is available at version 2.6; no confirmed active exploitation or public exploit code has been identified at time of analysis.

Local File Inclusion in the Tonda WordPress theme (versions below 2.6) enables unauthenticated remote attackers to manipulate PHP include statements and read arbitrary files from the server filesystem. The vulnerability is network-exploitable without authentication, but the CVSS AC:H rating indicates exploitation requires specific conditions or input validation bypass rather than trivial mass exploitation. Vendor patch is available at version 2.6; no public exploit or CISA KEV listing has been identified at time of analysis.

Local File Inclusion in the Verdure Core WordPress plugin (versions ≤ 1.2) allows unauthenticated remote attackers to include arbitrary files from the server's filesystem by passing unsanitized input to PHP include/require statements. Successful exploitation can expose sensitive server files such as wp-config.php - disclosing database credentials - and, under certain PHP configurations, may enable remote code execution through log poisoning or PHP wrapper abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector lowers the barrier for opportunistic targeting of vulnerable WordPress installations.

Local File Inclusion in the Golo Framework WordPress plugin before version 1.7.5 allows unauthenticated remote attackers to read arbitrary local files from the server - including wp-config.php containing database credentials - and potentially achieve code execution via PHP file inclusion mechanisms. The flaw stems from CWE-98: user-controlled input is passed unsanitized to PHP include/require statements, exploitable over the network without credentials or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network-accessible attack surface and CVSS 8.1 score make this a meaningful risk for any WordPress installation running the affected plugin.

Local File Inclusion in Events Made Easy WordPress plugin (all versions through 3.2.5) allows contributor-level authenticated attackers to inject path-traversal payloads into the eme_single_event_page_template function, causing the server to include and execute arbitrary PHP files. The attack is persistent and passive: once a malicious event is saved, the payload fires automatically for any visitor who loads the affected single-event page, requiring no further attacker interaction post-submission. If the environment permits PHP file uploads, this escalates to full remote code execution; even without upload capability, existing PHP files can be included to bypass access controls or exfiltrate sensitive data. No public exploit identified at time of analysis.

Local File Inclusion in the Resido WordPress theme (versions 1.5 and below) allows unauthenticated remote attackers to include arbitrary files server-side via unsanitized PHP include/require logic. The CVSS 3.1 score of 8.1 with full Confidentiality, Integrity, and Availability impact reflects the potential for sensitive file disclosure, server-side code execution via log poisoning or similar LFI chaining techniques, and service disruption - though the High Attack Complexity metric signals that reliable exploitation requires specific preconditions. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Unauthenticated Local File Inclusion in the Restaurant Menu by MotoPress WordPress plugin (versions ≤ 2.4.11) exposes WordPress deployments to arbitrary local file disclosure and potential remote code execution via PHP file-inclusion chains. The CVSS vector (AV:N/AC:H/PR:N/UI:N) confirms network exploitation requires no authentication or user interaction, though the high-complexity rating indicates specific server-side conditions or path knowledge are needed to reliably trigger the flaw. No confirmed active exploitation appears in CISA KEV and no public exploit code has been identified at time of analysis.

Local File Inclusion in the Theme Test Drive WordPress plugin (versions <= 2.9.1) enables unauthenticated network-based attackers to supply arbitrary file paths to the theme preview mechanism, potentially exposing sensitive server files such as wp-config.php and - under certain server configurations - escalating to remote code execution via log poisoning or similar chaining techniques. The vulnerability is classified under CWE-98 (PHP File Inclusion) with a CVSS 8.1 score reflecting no authentication requirement but elevated attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis.

Remote Local File Inclusion in Vavo Core WordPress plugin versions 2.3.0 and earlier enables unauthenticated network-based attackers to include arbitrary local files from the server filesystem. Affecting WordPress installations running the spabrice-developed plugin, exploitation can expose highly sensitive files such as wp-config.php, leading to database credential theft and potential full site compromise. No public exploit has been identified at time of analysis, though the CVSS 8.1 score with High impact across all three dimensions signals significant severity if the preconditions for exploitation are met.

Unauthenticated Local File Inclusion (LFI) in the Biagiotti Core WordPress plugin versions up to and including 2.1.1 allows network-accessible attackers to include arbitrary local files on the server without any credentials. The CVSS 8.1 score with full C/I/A impact ratings reflects the potential to chain LFI into remote code execution via techniques such as log poisoning or session file inclusion, not merely passive file disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H metric signals that exploitation requires specific server-side preconditions to achieve full impact.

Local File Inclusion in the Foton Core WordPress plugin (versions ≤ 1.1.1, developed by Mikado Themes) enables unauthenticated remote attackers to supply attacker-controlled file paths to PHP include/require functions, potentially exposing sensitive server files such as wp-config.php or enabling remote code execution via log-poisoning techniques. The CVSS vector confirms unauthenticated network-level access (AV:N/PR:N) with high confidentiality, integrity, and availability impact, though the AC:H rating signals that specific conditions must align for successful exploitation. No public exploit code or active exploitation has been confirmed at time of analysis; the Patchstack advisory is the sole disclosure source.

Local File Inclusion in the Barista WordPress theme (edge-themes) version 2.5.1 and earlier allows unauthenticated remote attackers to include arbitrary local files via crafted HTTP requests, with potential full confidentiality, integrity, and availability compromise. The CVSS 8.1 score reflects high impact across all three pillars, though the AC:H rating indicates exploitation requires elevated complexity - such as specific server conditions or chained techniques like log poisoning to escalate beyond file disclosure to code execution. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.

Unauthenticated Local File Inclusion in the Geo Mashup WordPress plugin (all versions through 1.13.18) enables a remote, unauthenticated attacker to include arbitrary local files from the server's filesystem, potentially exposing sensitive configuration data or achieving remote code execution through chained techniques such as log poisoning. Reported by Patchstack, the flaw is classified under CWE-98, targeting PHP's include/require mechanism within the plugin. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the CVSS 8.1 score reflects a high-severity, zero-privilege-required attack path.

Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem, potentially yielding full confidentiality, integrity, and availability compromise. Reported by Patchstack and registered under ENISA EUVD-2026-53913, the flaw stems from CWE-98 (PHP file inclusion without proper input sanitization). No public exploit code or CISA KEV entry has been identified at time of analysis, but the network-accessible, zero-authentication attack path makes patching a priority for any WordPress operator running this plugin.

Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.

Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.

Local File Inclusion in the Select-Themes "Tonda" WordPress theme (all versions through 2.5) lets an authenticated attacker with low privileges coerce a PHP include/require statement into loading arbitrary local files on the server. Tracked as CVE-2026-57805 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating and enables disclosure of sensitive files such as wp-config.php, with potential escalation to code execution via log/session poisoning. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local File Inclusion in the CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin (versions up to and including 5.11.1) lets an authenticated low-privileged attacker coerce the application into including arbitrary local PHP files, exposing sensitive files and potentially executing attacker-influenced code within the site context. Classified as CWE-98 (PHP Remote/Local File Inclusion) and reported by Patchstack, the flaw carries a CVSS 3.1 base score of 7.5 with high impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and no active exploitation on record.

Local File Inclusion in the Select-Themes Struktur Core WordPress plugin (all versions up to and including 2.5.1) lets an authenticated low-privileged user coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive server-side content such as wp-config.php credentials. Reported by Patchstack and classified under CWE-98 (PHP Remote File Inclusion), the flaw carries a CVSS 3.1 score of 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. Depending on server configuration, LFI of attacker-influenced content (e.g., poisoned logs or uploaded files) can escalate to PHP code execution.

Local File Inclusion in the Select-Themes "Struktur" WordPress theme (all versions up to and including 2.5.1) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive content such as wp-config.php credentials and, under the right conditions, escalating to code execution. Tracked as CVE-2026-57802 (CWE-98) and reported by Patchstack, it carries a CVSS 7.5 rating; there is no public exploit identified at time of analysis and it is not on CISA KEV. The CVSS vector's PR:L indicates authentication is required and AC:H reflects non-trivial exploitation preconditions.

PHP Local File Inclusion in the Select-Themes SetSail WordPress theme (versions up to and including 2.1) allows an authenticated attacker to coerce the application into including local files via improper control of a filename in an include/require statement. Successful exploitation can disclose sensitive files (e.g., wp-config.php) and, depending on server conditions, escalate to code execution through log poisoning or PHP wrapper abuse. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no CISA KEV listing.

Local File Inclusion in the Edge-Themes 'Overworld' WordPress theme (versions up to and including 1.5) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary server-side files, disclosing sensitive data such as wp-config.php credentials and potentially escalating to code execution via log/session poisoning. The flaw was reported by Patchstack and is classified as CWE-98 (PHP Remote File Inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.

Local file inclusion in the uxper Nuss WordPress theme (versions up to and including 1.3.6) lets an authenticated attacker with low-privilege access coerce the theme into including arbitrary PHP-parsable files from the server via improperly controlled include/require paths (CWE-98). Successful exploitation can disclose sensitive files and, depending on what can be included, lead to code execution, with high confidentiality, integrity, and availability impact per the CVSS 7.5 rating. No public exploit identified at time of analysis; the flaw was reported through Patchstack.

Local File Inclusion in the NewsPlus Shortcodes WordPress plugin (versions up to and including 4.2.0) allows an authenticated attacker to coerce the plugin into including arbitrary PHP-processable files from the server, enabling disclosure of sensitive files and potential code execution. The flaw stems from improper control of a filename passed to a PHP include/require statement (CWE-98). No public exploit was identified at the time of analysis, and it is not listed in CISA KEV; risk is moderated by high attack complexity and a required privilege level.

Local File Inclusion in the VLThemes Leedo WordPress theme (versions up to and including 3.0.0) allows authenticated attackers to include and execute arbitrary local files on the server via improper control of a filename passed to a PHP include/require statement. Although classified under PHP Remote File Inclusion (CWE-98), Patchstack characterizes the practical impact as Local File Inclusion, enabling disclosure of sensitive files and potential code execution from locally accessible content. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.

Local File Inclusion in the Kitchor WordPress theme by themelexus (versions up to and including 1.4.3) allows an authenticated attacker to coerce a PHP include/require statement into loading arbitrary local files from the server. Because the theme fails to constrain the filename passed to an include path (CWE-98), an attacker with at least low-level authenticated access can read sensitive files such as wp-config.php and, under the right conditions, escalate to PHP code execution via log poisoning or inclusion of attacker-influenced content. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.5.

Local file inclusion in the uxper Golo Framework WordPress plugin (versions up to and including 1.7.3) lets an authenticated attacker abuse an improperly validated include/require path to read arbitrary server-side files and potentially execute embedded PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) indicates network-reachable exploitation requiring low-level authentication and elevated attack complexity, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Local File Inclusion in the Elated-Themes 'Flow' WordPress theme (all versions up to and including 1.8) lets an authenticated attacker abuse an improperly controlled include/require path to read local files and potentially execute PHP. The CVSS 3.1 vector (AV:N/AC:H/PR:L) indicates a network-reachable but low-privilege, high-complexity flaw. No public exploit identified at time of analysis, and it is not listed in CISA KEV; disclosure comes from Patchstack.

Local file inclusion in the Mikado-Themes "Dor" WordPress theme (all versions through 2.4.1) lets an authenticated attacker with low privileges supply a crafted filename to a PHP include/require statement, causing the server to include and execute arbitrary local files. Patchstack attributes it to improper control of a filename passed to a PHP include path (CWE-98), enabling disclosure of sensitive files and potential code execution. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the high CVSS (7.5) reflects the full-impact potential once the low-privilege prerequisite is met.

Local file inclusion in the ThemeMove Brook WordPress theme (versions up to and including 2.9.0) lets authenticated attackers coerce a PHP include/require statement into loading arbitrary local files on the server, exposing sensitive data such as wp-config.php credentials and potentially escalating to code execution. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.5, but exploitation is rated high-complexity (AC:H) and requires at least low-level authentication (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local File Inclusion in the jwsthemes Aqua WordPress theme (versions up to and including 5.1.2) lets an authenticated attacker coerce a PHP include/require statement into loading arbitrary local files, exposing sensitive data and potentially achieving code execution. Reported by Patchstack under CWE-98, the flaw carries CVSS 7.5 but requires low-level privileges and high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local File Inclusion in the ThemeMove 'Billey' premium WordPress theme (versions up to and including 2.1.8) lets an authenticated attacker with low privileges control a filename used in a PHP include/require statement, exposing sensitive server-side files such as wp-config.php. Classified by Patchstack under CWE-98 (PHP Remote File Inclusion) but resolving to Local File Inclusion in practice, the flaw carries a CVSS 7.5 rating and no public exploit identified at time of analysis. Under specific conditions PHP file inclusion can escalate from information disclosure toward code execution via techniques such as log poisoning.

Local File Inclusion in the Edge-Themes "Aalto" WordPress theme (all versions up to and including 1.8) lets an authenticated attacker control a filename passed to a PHP include/require statement, exposing local files and potentially executing PHP. The flaw was reported by Patchstack and carries CVSS 7.5; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Despite the CWE-98 "Remote File Inclusion" classification, the described impact is Local File Inclusion.

PHP Local File Inclusion in the WordPress RT-Theme 18 | Extensions plugin (rt18-extensions) by stmcan lets remote attackers coerce the plugin into including attacker-influenced local file paths in an include/require statement, exposing sensitive files and potentially achieving code execution if a suitable includable file exists. All versions from an unspecified start through 2.5 are affected. No public exploit identified at time of analysis and it is not on CISA KEV, but the CVSS 3.1 base score is 8.1 (high) and the flaw is reachable without authentication.

Local File Inclusion in the LA-Studio Element Kit for Elementor WordPress plugin (all versions through 1.6.1) lets authenticated contributors and above coerce the get_type_template function into including arbitrary server-side .php files, enabling access-control bypass, sensitive data disclosure, and full PHP code execution where an attacker can plant a .php file. Reported by Wordfence with a CVSS 3.1 base score of 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV. The flaw stems from wp_normalize_path being relied upon for path safety even though it only canonicalizes separators and never rejects traversal sequences.

Local File Inclusion in the SportsPress Pro WordPress plugin (versions 2.7.29 and earlier) lets an authenticated user holding at least Contributor privileges cause the application to include and disclose arbitrary local files on the server. Because the flaw is rooted in unsafe PHP file inclusion (CWE-98), a successful attacker can read sensitive files such as wp-config.php and, depending on which local files can be included, potentially escalate toward code execution. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the finding is documented by Patchstack.

Local File Inclusion in the Shopify (Shopify Help Center) WordPress plugin through version 1.0.0 allows an authenticated user with at least Contributor privileges to include and read arbitrary local files on the server, potentially escalating to code execution via CWE-98-style file-inclusion abuse. The flaw was reported by Patchstack and carries a CVSS 7.5 rating driven by high confidentiality, integrity, and availability impact but with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Unauthenticated Local File Inclusion in the Audrey WordPress theme (elated-themes) affects all versions up to and including 1.5, letting remote attackers coerce the PHP application into including arbitrary files. Because CWE-98 covers PHP file-inclusion flaws, a successful include can leak sensitive files (wp-config.php, credentials) and, where remote or attacker-controlled content is includable, escalate to code execution. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV, though the network-reachable, unauthenticated nature (CVSS 8.1) makes it a meaningful patching priority for sites running this theme.

Local File Inclusion in the Pearl - Corporate Business WordPress theme (StyleMixThemes) versions 3.4.10 and earlier lets unauthenticated remote attackers coerce the application into including arbitrary local files, exposing sensitive server-side content such as configuration files and credentials. Rated CVSS 8.1 by Patchstack, the flaw requires no authentication (PR:N) but carries high attack complexity (AC:H), and depending on include handling could escalate from information disclosure toward code execution. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score supplied in the source data.