Local File Inclusion

The Welldone WordPress theme through version 2.4 contains a local file inclusion vulnerability in its PHP include/require handling that enables unauthenticated remote attackers to read arbitrary files from the affected server. With a CVSS score of 8.1, this vulnerability allows full compromise of confidentiality and integrity without requiring user interaction. No patch is currently available, making immediate mitigation through other means necessary.

Remote attackers can include arbitrary local files in the smartSEO WordPress theme (≤2.9) via a PHP Local File Inclusion vulnerability, potentially exposing sensitive configuration data or enabling server-side code execution. Despite high CVSS (8.1), EPSS exploitation probability is low (0.15%, 36th percentile) with no confirmed active exploitation or CISA KEV listing. The vulnerability requires specific preconditions that increase attack complexity (AC:H), though exploitation succeeds without authentication or user interaction once conditions are met.

Local file inclusion in ThemeREX Muzicon WordPress theme versions ≤1.9.0 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem and potentially execute PHP code. Despite a CVSS score of 8.1, real-world risk is moderated by high attack complexity (AC:H) and no confirmed active exploitation - EPSS probability is only 0.15% (36th percentile). The Patchstack report confirms the vulnerability but no public exploit code has been identified at time of analysis.

Local File Inclusion (LFI) in ThemeREX Save Life WordPress theme versions 1.2.13 and earlier enables remote unauthenticated attackers to read arbitrary files from the server filesystem and potentially achieve code execution by including uploaded or log files. Despite the network attack vector (AV:N), high attack complexity (AC:H) suggests successful exploitation requires specific server configurations or carefully crafted payloads. EPSS score of 0.15% (36th percentile) indicates low current exploitation probability, and no active exploitation is confirmed per CISA KEV or public exploit databases at time of analysis.

Local file inclusion in Artrium WordPress theme versions ≤1.0.14 allows remote unauthenticated attackers to read arbitrary server files and potentially execute PHP code through improper file inclusion controls. Despite a high CVSS 8.1 score, EPSS shows only 0.15% exploitation probability (36th percentile), suggesting limited real-world targeting. The vulnerability was disclosed by Patchstack's audit team with no confirmed active exploitation or public POC at time of analysis, though LFI vulnerabilities in WordPress themes are commonly targeted once proof-of-concept code becomes available.

Remote file inclusion vulnerability in ThemeREX WealthCo WordPress theme versions up to 2.18 allows unauthenticated remote attackers to include and execute arbitrary PHP files via manipulated filename parameters. Despite CVSS 8.1 rating, EPSS exploitation probability is low (0.15%, 36th percentile) with no CISA KEV listing or public exploit identified at time of analysis. Vulnerability stems from improper validation of file paths in PHP include/require statements, though attack complexity is rated High, suggesting specific conditions or chained exploitation required.

Local file inclusion in ThemeREX Marcell WordPress theme versions ≤1.2.14 allows remote attackers to read arbitrary files from the server filesystem and potentially execute malicious code. The vulnerability stems from improper validation of file paths in PHP include/require statements. Exploitation probability is low (EPSS 0.15%) with no confirmed active exploitation or public proof-of-concept at time of analysis. Discovered and reported by Patchstack's security audit team.

Local file inclusion in ThemeREX RexCoin WordPress theme versions up to 1.2.6 allows remote attackers to read arbitrary files and potentially achieve code execution without authentication. Despite the high CVSS score of 8.1, the low EPSS percentile (36%) and AC:H complexity suggest limited active exploitation. Patchstack audit team reported this vulnerability with proof-of-concept available, indicating realistic exploit feasibility against improperly configured installations.

Local file inclusion in ThemeREX Ozisti WordPress theme versions up to 1.1.10 enables remote unauthenticated attackers to read arbitrary files from the web server filesystem and potentially execute PHP code by including malicious local files. Despite the high CVSS score of 8.1, exploitation requires high complexity (AC:H) and EPSS indicates only 0.15% probability of exploitation in the wild (36th percentile), suggesting limited real-world targeting. No active exploitation confirmed by CISA KEV, though Patchstack has documented the vulnerability with security researchers.

Local File Inclusion in ThemeREX Sounder WordPress theme versions through 1.3.11 enables remote attackers to include and execute arbitrary local PHP files without authentication. Despite the CVE title referencing 'Remote File Inclusion', technical analysis and Patchstack classification confirm this is a Local File Inclusion (LFI) vulnerability. With EPSS at 0.15% (36th percentile), widespread exploitation is unlikely, but successful attacks achieve high impact across confidentiality, integrity, and availability. No active exploitation confirmed via CISA KEV at time of analysis.

Local file inclusion in ThemeREX Coleo WordPress theme (versions ≤1.1.7) allows remote attackers to read arbitrary files and potentially execute PHP code via crafted file path manipulation. Despite high CVSS 8.1, exploitation requires high attack complexity (AC:H), and EPSS score of 0.15% (36th percentile) suggests limited real-world exploitation activity. No CISA KEV listing indicates this is not confirmed as actively exploited, though Patchstack database inclusion suggests security researcher identification and likely proof-of-concept existence.

Local file inclusion (LFI) vulnerability in ThemeREX Gamezone WordPress theme versions up to 1.1.11 allows remote unauthenticated attackers to read arbitrary files from the web server, potentially exposing configuration files, credentials, and sensitive application data. The CVSS score of 8.1 reflects high complexity exploitation requiring specific conditions, while the low EPSS score (0.15%, 36th percentile) indicates minimal observed exploitation attempts in the wild. No active exploitation confirmed by CISA KEV at time of analysis.

PHP Local File Inclusion in ThemeREX Daiquiri WordPress theme versions ≤1.2.4 allows remote attackers to read arbitrary files or execute PHP code by exploiting improper filename control in include/require statements. Despite high CVSS (8.1), real-world risk is moderate: EPSS exploitation probability is low (0.15%, 36th percentile), no confirmed active exploitation exists, and attack complexity is high (AC:H). Patchstack audit identified this vulnerability, suggesting professional security review but no public exploit code at time of analysis.

Local file inclusion vulnerability in ThemeREX Aqualots WordPress theme versions up to 1.1.6 enables remote attackers to include arbitrary PHP files on the server without authentication. Despite the description's mention of 'remote file inclusion', the CVE is classified as CWE-98 (PHP Local File Inclusion) and tagged as LFI by Patchstack, indicating attackers can read sensitive files or execute local PHP code. EPSS exploitation probability is low (0.15%, 36th percentile) with no evidence of active exploitation or public POCs, though the high-complexity network attack vector suggests targeted exploitation scenarios.

Local file inclusion in ThemeREX Filmax WordPress theme versions ≤1.1.11 enables remote attackers to read arbitrary files from the web server and potentially execute malicious code. The vulnerability stems from improper filename validation in PHP include/require statements, categorized as CWE-98. Despite a CVSS score of 8.1, EPSS probability is low (0.15%, 36th percentile), suggesting targeted rather than widespread exploitation. Patchstack database identifies this as affecting information disclosure through LFI techniques, with no confirmed active exploitation or KEV listing at time of analysis.

Local file inclusion vulnerability in ThemeREX Run Gran WordPress theme versions through 2.0 allows remote attackers to read arbitrary files from the web server filesystem via crafted PHP include statements. Despite the moderate EPSS score (0.15%, 36th percentile), the high-complexity attack vector suggests exploitation requires specific knowledge of file paths or application structure. No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept code identified at time of analysis. Patchstack has documented this vulnerability, indicating awareness within the WordPress security community.

Local file inclusion in ThemeREX Mahogany WordPress theme versions through 2.9 enables remote unauthenticated attackers to read arbitrary files from the web server filesystem via manipulated PHP include/require statements. While classified as high-severity (CVSS 8.1), real-world exploitation risk appears moderate given the EPSS score of 0.15% (36th percentile) and high attack complexity rating. No active exploitation or public exploit code identified at time of analysis. Patchstack security audit identified and disclosed this vulnerability.

PHP Local File Inclusion in ThemeREX Bazinga theme for WordPress (versions ≤1.1.9) allows remote unauthenticated attackers to include and execute arbitrary local files via improper filename control in require/include statements. Despite high CVSS 8.1 severity, EPSS exploitation probability is low (0.15%, 36th percentile), and no active exploitation or public POC has been identified at time of analysis. Patchstack database reports this as both a local file inclusion vector and potential information disclosure issue, suggesting exploitation could lead to code execution through PHP file inclusion or exposure of sensitive configuration data.

Local file inclusion in the ThemeREX Windsor WordPress theme allows remote attackers to include and execute arbitrary PHP files on the server through improper filename control. Affects all versions through 2.5.0. Despite CVSS 8.1 (High), EPSS indicates low exploitation probability (0.15%, 36th percentile), suggesting limited attacker interest. No active exploitation confirmed via CISA KEV at time of analysis. Patchstack database lists this vulnerability with PHP and information disclosure tags, indicating potential for data exfiltration beyond code execution.

Local File Inclusion in Conquerors WordPress theme 1.2.13 and earlier enables remote attackers to read arbitrary files from the server filesystem, potentially exposing configuration files, credentials, and sensitive data. Despite a CVSS score of 8.1, EPSS exploitation probability is low (0.15%, 36th percentile) with no confirmed active exploitation or public POC at time of analysis. However, the network-accessible attack vector with no authentication requirement makes this a priority for sites running the affected theme.

Local file inclusion in ThemeREX Vapester WordPress theme versions ≤1.1.10 allows remote unauthenticated attackers to read arbitrary files from the web server, potentially exposing configuration files, credentials, and sensitive application data. Despite high CVSS score of 8.1, EPSS probability of 0.15% (36th percentile) suggests limited observed exploitation attempts. No active exploitation confirmed by CISA KEV, though Patchstack database listing indicates vulnerability is known to security researchers.

Local file inclusion in ThemeREX Le Truffe WordPress theme versions up to 1.1.7 enables remote attackers to read arbitrary files from the web server without authentication. While CVSS scores 8.1 (High), EPSS exploitation probability is low (0.15%, 36th percentile) with no confirmed active exploitation. The vulnerability stems from improper filename control in PHP include/require statements, allowing path traversal to access sensitive server files. No public exploit code identified at time of analysis.

Local File Inclusion in ThemeREX Rhythmo WordPress theme through version 1.3.4 allows remote unauthenticated attackers to read arbitrary files on the server and potentially achieve remote code execution through log file poisoning or PHP wrapper exploitation. Despite network attack vector (AV:N) and high impact ratings (C:H/I:H/A:H), EPSS probability remains low at 0.15%, and no active exploitation has been confirmed in CISA KEV. Attack complexity is rated HIGH (AC:H), indicating specific conditions or timing required for successful exploitation.

Local File Inclusion vulnerability in ThemeREX Bassein WordPress theme versions up to 1.0.15 allows remote unauthenticated attackers to include and execute arbitrary PHP files on the server via improper filename handling. Despite CVSS 8.1 High severity, EPSS exploitation probability is only 0.15% (36th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis. Patchstack advisory indicates this is a PHP file inclusion flaw affecting theme installations.

Local file inclusion in ThemeREX Legrand WordPress theme versions ≤2.17 allows remote attackers to read arbitrary files from the server filesystem through improper filename validation in PHP include/require statements. Despite high CVSS 8.1, EPSS exploitation probability is low (0.15%, 36th percentile) with no confirmed active exploitation or public exploit code. Reported by Patchstack security research team, this represents a moderate real-world risk primarily for installations where attackers can control file path parameters.

Local file inclusion in ThemeREX Eject WordPress theme versions up to 2.17 enables remote attackers to read arbitrary files on the server or execute PHP code without authentication. Despite high CVSS 8.1 severity, EPSS exploitation probability remains low at 0.15% (36th percentile) with no confirmed active exploitation. Patchstack security audit identified the vulnerability as a PHP file inclusion flaw allowing information disclosure through improper filename control in include/require statements.

Local file inclusion in ThemeREX Edge Decor WordPress theme through version 2.2 allows remote attackers to read arbitrary files on the server and potentially execute code via improper control of PHP include/require statements. Despite a CVSS score of 8.1, real-world exploitation risk appears moderate with EPSS at 0.15% (36th percentile) and no evidence of active exploitation or public POC. Attack complexity is rated high (AC:H), suggesting exploitation requires specific conditions beyond default configuration.

Local file inclusion in ThemeREX Asia Garden WordPress theme (versions ≤1.3.1) allows remote attackers to include and execute arbitrary PHP files on the server. Despite a CVSS base score of 8.1 (High), the EPSS score of 0.15% (36th percentile) indicates low observed exploitation probability in the wild. The vulnerability requires high attack complexity (AC:H) but no authentication (PR:N), enabling unauthenticated remote exploitation under specific conditions. Patchstack database confirmed this LFI vulnerability affecting WordPress installations using this theme.

Local file inclusion in ThemeREX Happy Baby WordPress theme versions ≤1.2.12 allows remote unauthenticated attackers to read arbitrary files from the web server and potentially execute PHP code. Patchstack reported this vulnerability (CWE-98) affecting file inclusion controls, though EPSS probability remains low at 0.15% with no confirmed active exploitation. The CVSS vector indicates network-based attack with high complexity but no authentication requirement, enabling confidentiality, integrity, and availability compromise.

Local file inclusion in ThemeREX Tiger Claw WordPress theme allows remote attackers to read arbitrary files from the web server and potentially execute code. Affects versions up to and including 1.1.14. Despite a high CVSS score of 8.1, the EPSS probability is low at 0.15% (36th percentile), suggesting limited exploitation attempts observed to date. No active exploitation confirmed by CISA KEV, though the vulnerability was reported by Patchstack's security research team.

Local file inclusion in ThemeREX S.King WordPress theme through version 1.5.3 allows remote unauthenticated attackers to read arbitrary files on the server and potentially execute PHP code via path manipulation in include/require statements. Despite the 8.1 CVSS score reflecting high severity, EPSS exploitation probability is low (0.15%, 36th percentile) and no active exploitation or public POC has been reported. Patchstack audit team disclosed this vulnerability affecting WordPress deployments using this theme.

Local File Inclusion (LFI) vulnerability in ThemeREX Dermatology Clinic WordPress theme versions ≤1.4.3 allows remote attackers to include and execute arbitrary PHP files on the server. Despite CVSS 8.1, EPSS score of 0.15% (36th percentile) indicates low probability of mass exploitation. Patchstack database confirms the vulnerability but no CISA KEV listing or public exploit code identified at time of analysis, suggesting limited real-world targeting of this WordPress theme.

Local file inclusion in ThemeREX Dixon WordPress theme through version 1.4.2.1 allows remote attackers to read arbitrary files from the server filesystem without authentication. Despite high attack complexity (AC:H), this vulnerability enables unauthorized access to sensitive configuration files, credentials, and potentially source code. EPSS score of 0.15% (36th percentile) indicates low probability of mass exploitation, consistent with targeting of a specific premium WordPress theme. No active exploitation confirmed (not in CISA KEV), but Patchstack public disclosure increases attack surface visibility.

Local file inclusion in ThemeREX Mandala WordPress theme versions ≤2.8 allows remote unauthenticated attackers to read arbitrary server files and potentially execute PHP code through improper filename control in include/require statements. Despite a CVSS score of 8.1, the EPSS probability remains low (0.15%, 36th percentile), suggesting limited attacker interest or exploitation barriers. No active exploitation or public proof-of-concept has been identified, and the vulnerability requires high attack complexity (AC:H), indicating specific conditions must be met for successful exploitation.

Local file inclusion in MCKinney's Politics WordPress theme versions ≤1.2.8 allows remote attackers to read arbitrary files on the server via path traversal in include/require statements. Despite the high CVSS score (8.1), EPSS probability is low (0.15%, 36th percentile) and no active exploitation is documented. Patchstack has cataloged this as a confirmed vulnerability affecting the ThemeREX-developed WordPress theme, enabling information disclosure through improper input validation in PHP file inclusion functions.

Local file inclusion in the M.Williamson WordPress theme through version 1.2.11 enables remote attackers to read arbitrary files from the server filesystem without authentication. Despite high-complexity exploitation barriers (CVSS AC:H), this vulnerability carries an 8.1 CVSS score due to complete compromise of confidentiality and integrity if successfully exploited. EPSS score of 0.15% (36th percentile) suggests low probability of mass exploitation. No active exploitation confirmed via CISA KEV, though Patchstack database inclusion indicates researcher discovery and analysis.

Local file inclusion in Legal Stone WordPress theme 1.2.11 and earlier allows remote attackers to read arbitrary files and potentially execute malicious code through improper filename control in PHP include/require statements. Exploitation probability remains low (EPSS 0.15%, 36th percentile) with no confirmed active exploitation, though the network-accessible attack vector and lack of authentication requirements present material risk for sites using this theme. Patchstack database reports this vulnerability affecting all versions through 1.2.11.

Local file inclusion in ThemeREX Miller WordPress theme through version 1.3.3 allows remote unauthenticated attackers to read arbitrary files and potentially execute malicious code via improper PHP include/require statement handling. CVSS rates this 8.1 (High) but EPSS exploitation probability is low at 0.15% (36th percentile), indicating targeted rather than widespread exploitation risk. Patchstack has documented this vulnerability but no CISA KEV listing exists, suggesting no confirmed active exploitation campaigns at time of analysis.

Local file inclusion in ThemeREX Peter Mason WordPress theme versions up to 1.4.5 allows remote unauthenticated attackers to include and execute arbitrary PHP files from the server's filesystem. The vulnerability stems from improper validation of file paths in include/require statements (CWE-98), enabling attackers to read sensitive files, execute malicious code, or escalate privileges. EPSS score of 0.15% (36th percentile) indicates relatively low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. Patchstack security research identified this flaw, suggesting security researchers are aware but widespread targeting is not yet evident.

Local file inclusion in ThemeREX Yacht Rental theme versions through 2.6 enables remote attackers to read arbitrary files on the web server without authentication. The vulnerability stems from improper validation of include/require statements, classified as CWE-98 (PHP Remote File Inclusion). While CVSS scores 8.1 (High), the low EPSS score (0.15%, 36th percentile) suggests minimal observed exploitation activity. Patchstack audit team identified and reported this WordPress theme vulnerability, which affects default configurations requiring no special prerequisites beyond network access to the WordPress installation.

Local file inclusion in ThemeREX Beacon WordPress theme versions ≤2.24 allows remote attackers to read arbitrary files from the web server through improper filename control in PHP include/require statements. Despite high-attack-complexity requirements (CVSS AC:H), this enables unauthenticated access to sensitive configuration files, credentials, and application source code. No public exploit identified at time of analysis, with low EPSS score (0.15%, 36th percentile) suggesting minimal observed exploitation activity. Patchstack advisory available but patched release version not independently confirmed.

Local file inclusion in the Police Department WordPress theme through version 2.17 allows remote attackers to read arbitrary files on the server and potentially achieve remote code execution through file disclosure and log poisoning techniques. Discovered by Patchstack's audit team, this vulnerability carries an EPSS score of 0.15%, indicating low probability of widespread exploitation despite its network-accessible attack vector. No public exploit code or active exploitation has been identified at time of analysis.

Local file inclusion in FlashMart theme versions ≤2.0.15 allows remote attackers to read arbitrary files on the server through improper filename validation in PHP include/require statements. With CVSS 8.1 (High) and CWE-98 classification, attackers can potentially access sensitive configuration files, credentials, and application source code. EPSS exploitation probability is low (0.15%, 36th percentile), indicating limited observed exploitation activity. Patchstack vulnerability database confirms the flaw affects the WordPress theme variant.

Local file inclusion in Magentech Victo WordPress theme through version 1.4.16 allows remote attackers to read arbitrary server files and potentially execute code. Despite CWE-98 classification as 'Remote File Inclusion', technical evidence and Patchstack tagging confirm local file inclusion behavior. EPSS score of 0.15% (36th percentile) indicates low observed exploitation probability. No CISA KEV listing or public POC identified at time of analysis, though Patchstack reporting suggests researcher awareness of exploitation technique.

Local file inclusion in ThemeREX Law Office WordPress theme versions up to 3.3.0 allows remote unauthenticated attackers to read arbitrary files from the server through improper PHP include/require controls. With EPSS score of 0.15%, this represents a moderate real-world exploitation probability. The vulnerability enables information disclosure attacks against WordPress sites using the affected theme, potentially exposing configuration files, credentials, and sensitive application data.

Local File Inclusion in N7 Golf Club WordPress theme through version 2.16.0 allows remote attackers to read arbitrary server files via crafted PHP file path manipulation. Despite CVSS 8.1, exploitation requires specific attack chain complexity (AC:H). EPSS 0.15% indicates minimal active exploitation observed. No CISA KEV listing or public POC identified at time of analysis, suggesting limited attacker interest in this WordPress theme vulnerability.

The ThemeREX Healer WordPress theme through version 1.0.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files on the server through improper handling of file include statements. An attacker can exploit this to access sensitive configuration files, database credentials, and other protected data without authentication. No patch is currently available and exploitation requires no user interaction.

Local File Inclusion in AncoraThemes Grit WordPress theme (versions ≤1.0.1) allows remote attackers to include arbitrary local files through improper validation of PHP include/require statements. Attack requires high complexity (CVSS AC:H) but no authentication, enabling unauthenticated attackers to achieve high confidentiality, integrity, and availability impact. EPSS score of 0.15% (36th percentile) indicates relatively low mass exploitation probability despite network attack vector. Patchstack audit team identified this vulnerability affecting PHP-based file operations with potential for information disclosure.

Local file inclusion in wpDataTables plugin for WordPress (versions up to 6.5.0.1) enables authenticated attackers to read arbitrary files from the web server filesystem with high complexity conditions. An attacker with low-privilege access can include PHP files or extract sensitive configuration data (database credentials, API keys) from readable server files. EPSS score of 0.13% (32nd percentile) indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis. Patchstack researchers disclosed this as a PHP local file inclusion weakness (CWE-98) exploitable over the network.

Local file inclusion in ThemeREX Printy theme versions through 1.8 allows remote attackers to read arbitrary files from the web server filesystem and potentially achieve code execution. Despite high CVSS 8.1, EPSS exploitation probability is low at 0.15% (36th percentile), suggesting limited attacker interest. Patchstack has published vulnerability details, but no public exploit code or active exploitation has been identified at time of analysis.

Local file inclusion in ThemeREX Progress WordPress theme version 1.2 and earlier allows remote attackers to read arbitrary files from the web server filesystem via PHP file inclusion flaws. Despite the 8.1 CVSS score, EPSS probability is low (0.15%, 36th percentile), indicating limited real-world exploitation activity. No CISA KEV listing confirms this remains a lower-priority vulnerability despite network reachability. Patchstack database identifies this as exploitable for information disclosure through local file access.

Local file inclusion in ThemeREX Edifice WordPress theme through version 1.8 allows remote attackers to read arbitrary files on the server and potentially execute PHP code by manipulating file inclusion parameters. Exploitation requires bypassing a high attack complexity barrier (AC:H) without authentication, making this a critical vulnerability for websites using affected versions. EPSS score of 0.15% indicates minimal observed exploitation activity in the wild, and no CISA KEV listing exists at time of analysis.

Local file inclusion in ThemeREX Tuning WordPress theme versions ≤1.3 enables remote attackers to read arbitrary files and potentially achieve code execution through PHP file inclusion mechanisms. Despite the high CVSS score (8.1), exploitation probability remains low (EPSS 0.15%, 36th percentile) and no active exploitation has been confirmed. Patchstack vulnerability database identifies this as affecting the Tuning theme through version 1.3, with the attack requiring high complexity network-based exploitation without authentication or user interaction.

Local file inclusion in ThemeREX Invetex WordPress theme versions ≤2.18 allows remote attackers to include and execute arbitrary PHP files from the server's filesystem, potentially leading to remote code execution, credential theft, or full site compromise. EPSS probability of 0.15% indicates relatively low observed exploitation despite network attack vector. Patchstack security audit identified the vulnerability in PHP file handling routines where inadequate validation enables path traversal to sensitive files.

Local file inclusion in ThemeREX Bonbon WordPress theme through version 1.6 enables remote attackers to read arbitrary files from the web server filesystem and potentially execute PHP code. Reported by Patchstack audit team with a 0.15% EPSS score (low exploitation probability), this vulnerability allows unauthenticated network-based attacks despite high complexity requirements. No active exploitation confirmed via CISA KEV, though the LFI attack pattern is well-understood by attackers. PHP-based themes with improper include/require statement controls are common attack surfaces in WordPress environments.

Local file inclusion in ThemeREX EmojiNation WordPress theme versions through 1.0.12 allows remote attackers to read arbitrary files on the web server without authentication. Despite a CVSS score of 8.1, EPSS probability of 0.15% (36th percentile) suggests limited real-world exploitation activity. Patchstack database reports this as a PHP local file inclusion vulnerability with information disclosure impact, indicating attackers can access sensitive configuration files, credentials, or source code to facilitate subsequent attacks.

Local file inclusion vulnerability in ThemeREX MoneyFlow WordPress theme version 1.0 and earlier enables remote attackers to read arbitrary files from the server filesystem and potentially execute PHP code. Reported by Patchstack security researchers, this vulnerability exploits improper validation of file paths in PHP include/require statements. With EPSS exploitation probability at 0.15% (36th percentile), widespread exploitation is not yet observed, though the network-accessible attack vector combined with high confidentiality, integrity, and availability impacts warrants immediate patching for sites using this theme.

Local file inclusion in ThemeREX Kayon WordPress theme versions through 1.3 enables remote attackers to read arbitrary files from the web server filesystem and potentially execute PHP code. Despite network-reachable attack vector (CVSS AV:N), exploitation requires high complexity conditions (AC:H) without authentication, resulting in a moderate EPSS score of 0.15% (36th percentile). Patchstack database lists this as an actively tracked vulnerability affecting WordPress installations, though no CISA KEV listing indicates limited widespread exploitation at time of analysis.

Local file inclusion in the Motorix WordPress theme versions 1.6 and earlier permits remote attackers to include and execute arbitrary PHP files on the server, despite high attack complexity. The vulnerability stems from improper validation of file paths in include/require statements. With EPSS exploitation probability at 0.15% (low percentile 36%), this appears to be a targeted WordPress theme vulnerability rather than widespread attack vector, though the CVSS score of 8.1 reflects the potential for complete system compromise if successfully exploited.

Local file inclusion in ThemeREX Stargaze WordPress theme versions through 1.5 allows remote unauthenticated attackers to read arbitrary files on the server and potentially execute malicious code. Reported by Patchstack security audit team. EPSS probability of 0.15% suggests low widespread exploitation likelihood, though network-accessible vector and high impact ratings warrant attention for sites using this theme. No active exploitation confirmed via CISA KEV at time of analysis.

Local file inclusion in axiomthemes Helion WordPress theme through version 1.1.12 enables remote attackers to read arbitrary files and potentially execute malicious code through improper filename validation in PHP include/require statements. While CVSS scores 8.1 (High) with network vector and no authentication required, attack complexity is rated High and EPSS shows only 0.15% exploitation probability (36th percentile), suggesting limited real-world weaponization. The CWE-98 classification indicates classic PHP file inclusion vulnerabilities where attacker-controlled input influences file paths in include() or require() functions. Patchstack database lists this as both LFI and information disclosure, indicating read access is confirmed while remote code execution depends on exploitation chain completeness.

Local File Inclusion (LFI) in ThemeREX Nuts WordPress theme versions through 1.10 allows remote attackers to read arbitrary files from the web server filesystem without authentication. While CVSS rates this 8.1 High, EPSS exploitation probability is low (0.15%, 36th percentile), suggesting limited active targeting. No CISA KEV listing or public exploit code identified at time of analysis, indicating this remains a theoretical risk requiring specific attack conditions despite the network-accessible vector.

Local File Inclusion in ThemeREX Foodie WordPress theme through version 1.14 allows remote unauthenticated attackers to read arbitrary files on the server and potentially execute malicious code. Despite the high CVSS score of 8.1, real-world exploitation likelihood remains low (EPSS 0.15%, 36th percentile) with no active exploitation confirmed at time of analysis. The vulnerability stems from improper validation of file paths in PHP include/require statements, classified as CWE-98.

Local file inclusion in ThemeREX Craftis WordPress theme versions through 1.2.8 enables remote attackers to read arbitrary server files and potentially achieve remote code execution via PHP file inclusion. The vulnerability stems from improper validation of filenames in include/require statements, allowing traversal to sensitive files. EPSS score of 0.15% indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. Patchstack has documented this vulnerability affecting all installations prior to version 1.2.9.

Local file inclusion vulnerability in ThemeREX Chroma WordPress theme versions ≤1.11 allows remote attackers to read arbitrary files from the web server filesystem through improper filename validation in PHP include/require statements. Despite high CVSS 8.1, EPSS probability is low (0.15%, 36th percentile) and no active exploitation is confirmed. Patchstack has documented this vulnerability, indicating professional security researcher awareness and likely forthcoming vendor response.

Local file inclusion in the Manoir WordPress theme version 1.11 and earlier allows remote unauthenticated attackers to read arbitrary files on the server through improper validation of file inclusion parameters. Despite the high CVSS score of 8.1, EPSS data indicates low real-world exploitation probability (0.15%, 36th percentile), suggesting this is likely a targeted risk rather than widespread threat. Patchstack database confirms the vulnerability exists but no active exploitation (KEV) or public proof-of-concept has been identified at time of analysis.

Local file inclusion vulnerability in ThemeREX Global Logistics WordPress theme through version 3.20 allows remote attackers to include arbitrary local files without authentication. Exploitation requires high complexity but no user interaction. With EPSS score of 0.15% (36th percentile), real-world exploitation probability remains low despite theoretical remote attack vector and lack of authentication requirements. Vulnerability identified by Patchstack audit team with public advisory available.

ThemeREX Green Thumb plugin version 1.1.12 and earlier contains a local file inclusion vulnerability in its PHP file handling that allows unauthenticated remote attackers to read arbitrary files from the affected server. The vulnerability stems from improper validation of filenames used in include/require statements, enabling file disclosure without authentication. No patch is currently available for this vulnerability.

Improper file inclusion handling in ThemeREX Luxury Wine plugin version 1.1.14 and earlier enables attackers to read arbitrary files on affected servers through local file inclusion attacks. The vulnerability requires network access but no authentication, allowing extraction of sensitive configuration data and source code. No patch is currently available for this high-severity issue affecting PHP-based WordPress installations.

ThemeREX ShiftCV versions up to 3.0.14 are vulnerable to local file inclusion through improper input validation in PHP include/require statements, allowing attackers to read arbitrary files on the affected server. With a CVSS score of 8.1, this vulnerability enables high-impact attacks including information disclosure and potential code execution, though exploitation requires specific conditions. No patch is currently available for affected installations.

ThemeREX Translogic through version 1.2.11 contains a local file inclusion vulnerability in PHP that enables attackers to read and potentially execute arbitrary files on affected systems without authentication. The improper handling of file include/require statements allows an attacker to manipulate filename inputs and access sensitive server files. No patch is currently available, and exploitation requires specific conditions (network accessible, no user interaction required).

Improper file inclusion handling in ThemeREX Kratz plugin versions 1.0.12 and earlier enables attackers to read arbitrary files from affected systems through a local file inclusion vulnerability. An unauthenticated attacker can exploit this over the network to access sensitive configuration files and other protected data without authentication. No patch is currently available for this high-severity vulnerability affecting PHP-based installations.

ThemeREX Gridiron through version 1.0.14 contains a local file inclusion vulnerability in PHP that allows unauthenticated attackers to read arbitrary files from the server by manipulating include/require statements. The vulnerability requires specific conditions to be met (AC:H) but could lead to full system compromise including confidentiality and integrity breaches. No patch is currently available, and exploitation remains unlikely in the near term based on current threat metrics.

ThemeREX Yottis plugin version 1.0.10 and earlier contains a local file inclusion vulnerability in PHP that permits unauthenticated attackers to read arbitrary files on the server through improper input validation on file inclusion parameters. The vulnerability requires specific conditions to exploit (high attack complexity) but could lead to complete system compromise including confidential data exposure and code execution. No patch is currently available for affected installations.

ThemeREX Scientia plugin versions 1.2.4 and earlier contain a local file inclusion vulnerability in PHP that allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability stems from improper validation of filename parameters in include/require statements, enabling attackers to traverse the filesystem and access sensitive data. With no patch currently available, affected PHP installations running vulnerable versions of Scientia are at immediate risk.

ThemeREX DroneX versions up to 1.1.12 contain a PHP local file inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability stems from improper validation of file paths in include/require statements, potentially enabling information disclosure or further system compromise. No patch is currently available for this issue.

ThemeREX Coinpress through version 1.0.14 contains a local file inclusion vulnerability in its PHP include/require handling that enables unauthenticated attackers to read arbitrary files from the affected server. The vulnerability has a high severity rating (CVSS 8.1) and currently lacks a security patch. Attackers can leverage this flaw to access sensitive configuration files, credentials, and other protected data accessible to the web server process.

ThemeREX Yungen plugin versions 1.0.12 and earlier contain a local file inclusion vulnerability in PHP file handling that allows attackers to read arbitrary files on the server. An unauthenticated remote attacker can exploit this weakness to access sensitive information or potentially execute code by manipulating filename parameters in include/require statements. No patch is currently available for this vulnerability.

ThemeREX Vixus through version 1.0.16 contains a local file inclusion vulnerability in its PHP include/require handling that enables attackers to read arbitrary files from the affected server. An unauthenticated remote attacker can exploit this by crafting malicious requests to access sensitive files and potentially execute arbitrary code. No patch is currently available, and exploitation requires specific conditions that increase the attack complexity.

ThemeREX Maxify through version 1.0.16 contains a local file inclusion vulnerability in its PHP file handling that allows unauthenticated attackers to read arbitrary files from the server. The vulnerability stems from improper validation of filenames in include/require statements, enabling attackers to traverse directories and access sensitive data. Currently no patch is available to remediate this issue.

ThemeREX Lingvico through version 1.0.14 contains a local file inclusion vulnerability in its PHP file handling that enables attackers to read arbitrary files on the affected system. The vulnerability requires network access but no authentication or user interaction, allowing an attacker to potentially disclose sensitive server information. No patch is currently available for this issue.

ThemeREX Justitia through version 1.1.0 contains a local file inclusion vulnerability in PHP that allows unauthenticated attackers to read arbitrary files on the server through improper control of file inclusion statements. This vulnerability has a CVSS score of 8.1, indicating high severity with potential for both information disclosure and system compromise. No patch is currently available, leaving affected installations vulnerable to exploitation.

ThemeREX Tediss versions 1.2.4 and earlier contain a local file inclusion vulnerability in their PHP include/require functionality, allowing unauthenticated attackers to read arbitrary files from the server. The vulnerability requires specific conditions to exploit (high complexity) but carries high impact including potential information disclosure and code execution. No patch is currently available for affected installations.

Local file inclusion in ThemeREX Aldo through version 1.0.10 enables unauthenticated attackers to read arbitrary files on the server through improper handling of include/require statements. The vulnerability allows remote attackers to access sensitive system files and potentially execute code with no authentication required. No patch is currently available for this high-severity flaw.

ThemeREX Meals & Wheels plugin version 1.1.12 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files on the server through improper handling of include/require statements. An attacker can exploit this vulnerability to access sensitive configuration files, source code, or other protected content without authentication. No patch is currently available, and exploitation difficulty is moderate with a CVSS score of 8.1 indicating high impact on confidentiality, integrity, and availability.

ThemeREX Avventure versions 1.1.12 and earlier contain a local file inclusion vulnerability in PHP file handling that allows unauthenticated attackers to read arbitrary files on the server. The vulnerability stems from improper validation of filenames in include/require statements, enabling attackers to traverse directories and access sensitive information. No patch is currently available for affected installations.

ThemeREX ConFix version 1.013 and earlier contains a local file inclusion vulnerability in PHP that allows unauthenticated remote attackers to read arbitrary files from the affected server. The vulnerability stems from improper validation of file paths in include/require statements, enabling attackers to traverse directories and access sensitive configuration files or source code. No patch is currently available for this high-severity vulnerability (CVSS 8.1).

ThemeREX Quanzo version 1.0.10 and earlier contains a local file inclusion vulnerability in PHP that allows unauthenticated attackers to read arbitrary files through improper handling of include/require statements. The high CVSS score of 8.1 reflects the potential for confidentiality and integrity compromise, though exploitation requires specific conditions. No patch is currently available for affected installations.

ThemeREX Equadio versions 1.1.3 and earlier contain a local file inclusion vulnerability in their PHP implementation that allows attackers to manipulate filename parameters in include/require statements to read arbitrary files from the system. An attacker with network access can exploit this vulnerability to disclose sensitive information such as configuration files or source code. No patch is currently available for this issue.

ThemeREX The Qlean WordPress theme through version 2.12 contains a local file inclusion vulnerability in its PHP file handling that enables attackers to read arbitrary files from the server. The vulnerability requires no authentication and can be exploited remotely to access sensitive configuration files and source code. While no patch is currently available, the relatively low EPSS score suggests limited real-world exploitation at this time.