Local File Inclusion

Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).

Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.

Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.

Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.

Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.

Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.

Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.

Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.

Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).

Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.

Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.

Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.

Local file inclusion in the Traveler WordPress theme prior to version 3.2.6 allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure, remote code execution, or full site compromise. Exploitation requires a high-complexity attack with no user interaction, and the EPSS exploitation probability is low (0.08%), with no known public exploitation or active attacks at the time of analysis.

Local file inclusion in the TieLabs Jannah WordPress theme up to version 7.6.0 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to sensitive information disclosure (e.g., wp-config.php) or remote code execution via log poisoning. The EPSS score of 0.22% indicates a low probability of imminent exploitation, and no public exploit code or active exploitation has been identified at time of analysis.

Local file inclusion in Task Manager WordPress plugin versions ≤3.0.2 enables authenticated attackers with low privileges to read arbitrary files from the web server through improper filename control in PHP include/require statements. Exploitation requires network access with high attack complexity. EPSS score of 0.06% (18th percentile) indicates low probability of mass exploitation. No active exploitation confirmed in CISA KEV at time of analysis, though Patchstack vulnerability database documents this as a disclosed LFI vulnerability.

Local file inclusion in Ray Enterprise Translation WordPress plugin through version 1.7.1 allows remote attackers to read arbitrary files on the server via path traversal in PHP include statements. Despite the moderate CVSS score of 7.5, the EPSS probability of 0.06% (20th percentile) indicates minimal observed exploitation activity in the wild. Patchstack has cataloged this vulnerability with proof-of-concept details, requiring attackers to overcome high complexity conditions and user interaction to achieve impact across confidentiality, integrity, and availability.

Local file inclusion in the Anchor smooth scroll WordPress plugin up to version 1.0.2 allows unauthenticated attackers to read arbitrary files from the server. This can expose sensitive data such as database credentials, and may be escalated to remote code execution under certain server conditions. No active exploitation has been confirmed, and a vendor fix is available.

Local file inclusion in Riode WordPress theme versions ≤1.6.23 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem, potentially exposing configuration files, credentials, and source code. The vulnerability stems from improper filename control in PHP include/require statements. Despite the high CVSS score of 8.1, EPSS indicates only 0.06% exploitation probability (18th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.

Local file inclusion in Thememove MinimogWP WordPress theme versions <=3.9.6 allows unauthenticated attackers over the network to include arbitrary local files, potentially leading to sensitive data disclosure and full server compromise. Exploitation has high attack complexity, and while no active exploitation or public exploit is reported, EPSS shows a low probability of widespread attacks.

Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).

Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.

PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.

Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.

Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.

Local file inclusion in AncoraThemes Fabrica theme for WordPress <=1.8.1 allows unauthenticated attackers to include and read arbitrary local files on the server, leading to information disclosure and, if chained with techniques like log poisoning or file upload, potential remote code execution. No active exploitation or public exploit has been confirmed; EPSS indicates a low exploitation probability (0.22%).

Unauthenticated remote attackers can exploit a PHP local file inclusion vulnerability in the OnLeash WordPress theme (versions ≤1.5.2) to read sensitive files or achieve remote code execution. No active exploitation or public exploit code has been identified as of this analysis.

Local file inclusion in the MaxCube WordPress theme (versions <= 1.3.1) enables unauthenticated attackers to include arbitrary local files via crafted requests, potentially exposing sensitive data, executing code, and modifying system files. The vulnerability stems from improper validation of filenames in PHP include/require statements. At the time of analysis, no active exploitation or public exploit code is known.

Local file inclusion in AncoraThemes W&D wd theme for WordPress allows unauthenticated attackers to read arbitrary local files and potentially achieve remote code execution. The vulnerability affects versions through 1.0 and has a CVSS 3.1 base score of 8.1, but EPSS predicts a very low exploitation probability (0.08%) with no known public exploits or active exploitation.

Local file inclusion in the Rare Radio WordPress theme (AncoraThemes, versions through 1.0.15.1) exposes WordPress installations to arbitrary PHP file inclusion via unsanitized user input passed to PHP include/require statements. An unauthenticated remote attacker with sufficient complexity can traverse the server filesystem to include PHP files already resident on the server, potentially achieving code execution, credential theft, and full site compromise. No public exploit code or active exploitation has been identified; EPSS is very low at 0.08% (23rd percentile), reflecting limited real-world threat at this time.

Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.

Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.

Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially

Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.

Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.

We are tasked with synthesizing data about CVE-2025-60044 into a comprehensive analysis. The input includes: CVE ID, description, CVSS 8.1 with vector, CWE-98, EPSS 0.08%, tags, and a reference to Patchstack. No KEV data, no patch details in the input beyond the description saying "through <= 1.1.0". The description says "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability ... allows PHP Local File Inclusion. This issue affects Fribbo: from n/a through <= 1.1.0." Note: The title says Remote File Inclusion but description says Local File Inclusion. Possibly a misclassification? CWE-98 is "Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", which often leads to remote file inclusion if the inclusion is not properly controlled. But the description says PHP Local File Inclusion. We'll handle this. We must output a JSON object with all fields. Let's interpret each: - product_name: "Fribbo" is a WordPress theme. So "Fribbo Theme" or just "Fribbo". Use "Fribbo Theme" maybe. - summary: Original synthesis, not copying description. Start with impact. Impact is local file inclusion (LFI), potentially leading to confidential data exposure, code execution if files are writable, etc. So: "Local file inclusion in the Fribbo WordPress theme (versions <= 1.1.0) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data or enabling remote code execution if coupled with file upload capabilities." Add that EPSS low, no known exploit, not KEV. - technical_context: PHP Include/Require, CWE-98, improper control of filename. WordPress theme, likely uses include() or require() with user-controllable input without proper sanitization. CPE data not provided explicitly, but we can infer from description: "from n/a through <= 1.1.0". So product is "Fribbo" (WordPress theme). Underlying technology: PHP, WordPress themes. CWE-98 refers to PHP Remote File Inclusion but this is LFI; the vulnerability class is file inclusion. Could be RFI if php:// wrappers are disabled or limited. Discuss the root cause. - risk_assessment: CVSS 8.1, AV:N, AC:H, PR:N, UI:N, S:U, C:H/I:H/A:H. AC:H suggests high attack complexity, perhaps due to specific conditions. EPSS 0.08% (low), no KEV, no POC mentioned. SSVC: not given, but we can reason: exploitation status: no known exploit, automatable? AC:H suggests not easily automatable. Technical impact: high (C/I/A all H). So real-world risk may be lower than CVSS suggests because of complexity and low EPSS. Could be a high CVSS but low real risk because product is not widely deployed? Unknown. State that data missing: no patch version specified, no vendor advisory link beyond Patchstack. Patchstack may have provided patch? Not in data. So "patch status unclear; advisory does not mention a fixed version". Also note that CVSS AC:H and no known public exploit. - affected_products: "Fribbo WordPress theme, versions n/a through 1.1.0. Patchstack advisory: [link]." No CPE string given but NVD might have one. - remediation: Not provided. Suggest upgrade to version beyond 1.1.0 if available. As the advisory doesn't specify a fixed version, "contact vendor or monitor Patchstack for update." Workarounds: Disable theme until patch; restrict file access to prevent sensitive file inclusion; disable dangerous PHP functions (allow_url_include) if not needed. But those are generic. Provide actionable. Since no patch, "No official patch available at this time; consider switching to a different theme, or apply web application firewall rules to block file inclusion attempts." - exploit_scenario: An attacker crafts a request to a vulnerable endpoint that includes a local file via directory traversal, e.g., ?file=../../wp-config.php, leading to disclosure of database credentials. - exploitation_conditions: From description, no explicit conditions, but CVSS vector says no user interaction, no privileges, so likely exploitable remotely without authentication. However, AC:H suggests some complexity, maybe the inclusion path is not directly controllable or requires certain PHP configuration. The description: "Improper Control of Filename for Include/Require Statement" means somewhere user input is used to construct a filename for inclusion. So condition: The theme must be active, and the vulnerable parameter must be present, possibly a specific page or AJAX action. So state: "Requires the Fribbo theme (version <= 1.1.0) to be active. Likely exploitable via an HTTP request to a theme component that accepts a filename parameter. No authentication required. High complexity hints at non-trivial exploitation, possibly due to needing to bypass path restrictions or require specific PHP settings (e.g., allow_url_include off)." - attack_chain: Access: Send crafted HTTP request with file path parameter → Exploit: Bypass filename sanitization (if any) → Include local file → Impact: Read sensitive file, achieve code execution via log poisoning or session file inclusion. But we need a chain in kill-chain phases. Let's do: 5-step: Access → Delivery → Exploit → Execution → Impact. Access: Attacker identifies target WordPress site running vulnerable theme. Delivery: Sends HTTP request to vulnerable theme script. Exploit: Parameter containing path traversal triggers file inclusion. Execution: PHP includes arbitrary local file, potentially leading to code execution if php wrappers used. Impact: Disclosure of sensitive data (wp-config.php) or code execution. So chain: "Identify site with Fribbo theme → Send crafted request with malicious file path → Bypass input sanitization to include local file → Execute included code or retrieve file contents → Extract credentials or compromise server." Alternatively, more concise: "Send HTTP request with ‘file’ parameter containing path traversal → Theme includes arbitrary PHP file → Read sensitive file or execute code." - confidence_notes: "Vulnerability reported by Patchstack, but no fixed version listed. Affected version range confirmed by advisory. No CISA KEV or public exploit. CVSS 8.1 indicates high impact but high complexity; EPSS low, suggesting limited real-world threat." I need to be specific: what's confirmed, inferred, unknown. - prevalence: Fribbo is a niche WordPress theme. Likely low prevalence. I'll go with "low". Prevalence_basis: "niche WordPress theme, presumably limited installation base." - assessed_cvss_vector: The existing vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Let's reassess: Attack vector is network (AV:N) as it's a WordPress theme accessible over the internet. Attack complexity high (AC:H) because exploitation might require specific conditions like certain PHP functions not disabled, or the include path must be constructed precisely. Now, what about impact? LFI can lead to reading arbitrary files, so C:H? If you read wp-config.php, yes, confidentiality high. Integrity high? If you can include a log file with PHP code, you could corrupt log files, but that's often not direct integrity impact. However, LFI can lead to RCE, and RCE can mess with system integrity. The CVSS given has C/I/A all High. Could be too aggressive. If only reading files, only C:H. But description says "file inclusion" which might include ability to include any local file, and if combined with file upload, could include a malicious file. But the base vulnerability only allows including local files that already exist, so integrity and availability impacts are less likely unless you can include a file that performs actions. Conservative: C:H, I:L, A:L? But the CVSS from the reporter is 8.1. I might assess slightly lower. Let's set AV:N, AC:H, PR:N, UI:N, S:U. Impact: C:H, I:L, A:L perhaps, but based on typical LFI, it's often confidentiality only unless there is a way to get code execution. If LFI leads to RCE via PHP wrappers (expect://, data://, etc.), that could give full impact. The description says "PHP Local File Inclusion" not Remote, but with wrappers it could be remote code. So the reporter might be assuming worst case. I'll keep assessed vector as close to theirs but justify if any difference. I'll say "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" but note that AC:H due to requirement that vulnerable parameter exists and PHP configuration might restrict wrappers. So assessed_cvss_vector: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H". Rationale: "Network-accessible theme with high complexity; full impact if successful, though integrity and availability depend on included file's content." Actually, we can create our own assessment: I'll use AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L, but they gave 8.1 with all High, so I'll stick with the given but acknowledge. I'll set the assessed vector to same as provided, as it's plausible if RCE possible. I'll note in rationale. - assessed_cvss40_vector: Map to 4.0: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Scope unchanged, so subsequent all N. AT:N. Precision rules: Exploitation status: neither KEV nor POC, so "no public exploit identified at time of analysis". Patch status: from the description, "through <= 1.1.0" means version 1.1.0 and below are affected. No fix version given, so "Patch available per vendor advisory" (Patchstack advisory might mention fix? The reference URL is Patchstack, but we don't have content. It says "Patch available" in the input? The input does not say patch available. It just gives a vulnerability report. So we cannot confirm patch. Use: "No vendor-released patch identified at time of analysis" but we only have the advisory from Patchstack, which might have a fix? We don't know. So I'll state: "No patch version confirmed; Patchstack advisory may have update details but not provided." In field, I'll write "Vendor patch status unclear; advisory from Patchstack does not specify a fixed version." So in remediation, advise checking Patchstack. Prevalence: "low" and basis: "obscure WordPress theme". Let's craft each field. product_name: "Fribbo Theme" (1-3 words: "Fribbo" alone is enough? I'll use "Fribbo" as product name, but add Theme for clarity: "Fribbo") summary: "Local file inclusion in Fribbo WordPress theme (<=1.1.0) enables unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive data exposure or code execution if combined with file upload or log manipulation. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability." technical_context: "The vulnerability arises from improper validation of user-supplied input used in PHP include/require statements, classified as CWE-98. The Fribbo theme, likely a commercial or niche WordPress product, fails to sanitize filenames passed to inclusion functions, allowing path traversal sequences. CPE data is not available, but the affected version range is from initial release up to 1.1.0. The underlying technology is PHP running on a WordPress site, where includes are server-side and do not require user interaction." risk_assessment: "CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high impact with complex exploitation. EPSS 0.08% (23rd percentile) suggests very low real-world threat. No CISA KEV or public POC known. The high attack complexity likely stems from the need to bypass any path restrictions or use PHP wrappers that might be disabled. This is a classic high-severity but low-risk scenario for most organizations because of product obscurity and lack of exploits. Missing data: No fix version confirmed; the advisory from Patchstack is the sole source." affected_products: "Fribbo WordPress theme, all versions up to and including 1.1.0. Advisory available at Patchstack (https://patchstack.com/database/Wordpress/Theme/fribbo/vulnerability/wordpress-fribbo-theme-1-1-0-local-file-inclusion-vulnerability?_s_id=cve)." remediation: "No fixed version is listed in the advisory. Users should contact AncoraThemes for a patch or update. As an immediate mitigation, deactivate the Fribbo theme and switch

Local file inclusion in the AncoraThemes Wanderic WordPress theme (versions up to and including 1.0.10) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to full host compromise through information disclosure or remote code execution. Exploitation requires high attack complexity, and no public exploit or confirmed active exploitation has been identified at this time, with EPSS probability at 0.08%.

Local file inclusion in the Chinchilla WordPress theme (version 1.16 and below) allows unauthenticated remote attackers to read arbitrary files on the server, risking information disclosure or remote code execution via log poisoning. The flaw arises from improper filename handling in PHP include/require statements. No public exploit or active exploitation has been identified, and the EPSS percentage remains very low.

Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).

Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.

Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).

Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.

Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.

Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.

Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.

Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.

Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.

Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.

Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.

Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.

Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).

Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.

Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.

Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.

PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.

Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.

Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.

Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.

Local file inclusion in AncoraThemes HealthHub WordPress theme up to version 1.3.0 permits unauthenticated attackers to read arbitrary local files via improper file path handling, potentially enabling remote code execution if a suitable upload or log chain exists. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low (0.08%). The vulnerability carries a CVSS 8.1 base score due to its unauthenticated network vector and high impact, though high attack complexity significantly limits practical exploitation.

Local file inclusion in the Otaku WordPress theme up to version 1.8.0 allows unauthenticated attackers to include arbitrary local PHP files, resulting in information disclosure, credential theft, or remote code execution. Exploitation requires high complexity and no public exploit or active attacks are currently confirmed. The vulnerability affects the AncoraThemes Otaku theme and is tracked as CVE-2025-58896.

Unauthenticated local file inclusion in AncoraThemes Integro WordPress theme ≤1.8.0 allows remote attackers to read arbitrary files on the server or potentially execute code. The vulnerability carries a CVSS 8.1 score but has low exploitation probability (EPSS 0.08%) and no evidence of active exploitation or public exploit code at the time of analysis.

Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.

Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).

Local file inclusion in the Tourimo WordPress theme (<=1.2.3) enables unauthenticated remote attackers to read arbitrary files and potentially execute arbitrary PHP code, leading to full site compromise. This vulnerability, reported by Patchstack, carries a CVSS score of 8.1 but has a low EPSS exploitation probability (0.08%), with no evidence of active exploitation or public exploit code.

Local file inclusion in the AncoraThemes Sanger WordPress theme up to version 1.24.0 allows unauthenticated remote attackers to include arbitrary local files, potentially disclosing sensitive data or executing arbitrary code under specific server conditions. No evidence of active exploitation exists, and the EPSS score of 0.08% indicates low likelihood of widespread attacks.

Local file inclusion vulnerability in the AncoraThemes Playful theme for WordPress up to version 1.19.0 allows unauthenticated attackers

Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.

Local file inclusion in AncoraThemes The Flash theme through version 1.15 enables unauthenticated attackers to read arbitrary files on the server, potentially exposing configuration files and leading to code execution. No public exploit has been identified, and EPSS probability is low (0.08%). The vulnerability is not listed in CISA KEV.

Local file inclusion in AncoraThemes Pathfinder WordPress theme through version 1.16 allows unauthenticated remote attackers to include arbitrary PHP files on the server, potentially leading to complete system compromise via code execution, though high attack complexity and very low exploitation probability (EPSS 0.08%) suggest limited real-world risk without specific server conditions.

Local file inclusion in AncoraThemes Festy theme for WordPress up to 1.13.0 allows unauthenticated remote attackers to read arbitrary files on the server. No known active exploitation, and EPSS indicates low probability (0.08%). Successful exploitation can expose sensitive configuration files but high attack complexity and no public exploit suggest lower immediate risk.

Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).

PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.

Local File Inclusion (LFI) in BZOTheme Monki WordPress theme versions through 2.0.5 allows unauthenticated remote attackers to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete system compromise. Despite the high 8.1 CVSS score, real-world exploitation probability remains low (EPSS 0.17%, 38th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis. The vulnerability stems from improper filename validation in PHP include/require statements, classified as CWE-98.

Local file inclusion in the AncoraThemes ChildHope WordPress theme (versions up to and including 1.1.8) lets an unauthenticated, remote attacker influence a PHP include/require statement and read arbitrary files on the underlying web server. The assessed vector is network-reachable with no authentication or user interaction (AV:N/PR:N/UI:N), but attack complexity is High (AC:H) because exploitation requires the attacker to supply a valid includable local path - or a workable wrapper/log-poisoning gadget - rather than issuing a single trivial request; escalation from disclosure to code execution further depends on server configuration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.50%, ~40th percentile), so real-world risk is driven primarily by whether the vulnerable theme is installed and active on an internet-exposed site. Note the independent assessment rates impact as C:H/I:L/A:L, slightly lower on integrity and availability than the vendor-published CVSS score of 8.1.

Local file inclusion in the AncoraThemes Gardis WordPress theme (versions up to and including 1.2.13) allows unauthenticated remote attackers to include and potentially execute arbitrary local files through an improperly controlled include/require statement. The flaw carries a CVSS 8.1 (AV:N/AC:H/PR:N/UI:N), but achieving full code execution depends on additional conditions such as a writable local target or an available PHP stream wrapper; otherwise the impact is limited to local file disclosure. No public exploit code identified at time of analysis, and the urgency is tempered by the theme's niche commercial nature and the high attack complexity.

Local file inclusion (LFI) in the AncoraThemes Palladio WordPress theme (versions ≤1.1.10) allows unauthenticated, network-based attackers to include local files on the server, potentially leading to information disclosure or, with additional conditions, remote code execution. The high attack complexity (AC:H) means exploitation requires a valid include path and an attacker-controllable local file; no public exploit code exists and exploitation has not been observed. The theme's niche deployment further limits real-world risk.

Local file inclusion in the Hanani WordPress theme (versions up to 1.2.11) allows unauthenticated remote attackers to include arbitrary local files, potentially enabling full server compromise. Exploitation complexity is high, and EPSS indicates very low real-world exploitation probability. No active exploitation or public proof-of-concept is known at this time.

Unauthenticated local file inclusion in the Jack Well WordPress theme (<=1.0.14) allows remote attackers to read arbitrary files or execute PHP code on the server via manipulated file paths. The vulnerability carries a CVSS 8.1 score but a low EPSS exploitation probability (0.08%); no active exploitation or public exploit is known at this time.

Local file inclusion in the AncoraThemes Ludos Paradise WordPress theme up to version 2.1.3 permits unauthenticated remote attackers to include arbitrary local files, exposing sensitive server data such as configuration files or credentials. The vulnerability is not known to be actively exploited, and no public exploit code is available. Despite a high CVSS rating, the low EPSS probability and high attack complexity suggest a limited real-world risk.

Local file inclusion in the Kings & Queens WordPress theme by AncoraThemes (through version 1.1.16) enables unauthenticated attackers

Unauthenticated local file inclusion in the Gracioza WordPress theme versions up to 1.0.15 lets remote attackers read arbitrary files and potentially execute code. The flaw stems from improper sanitization of filenames used in include statements (CWE-98). No known public exploit or active exploitation is confirmed at the time of analysis.

Local File Inclusion in the Mamita WordPress theme (AncoraThemes, versions ≤ 1.0.9) exposes sites to unauthenticated path-traversal attacks where unsanitized input is passed directly to a PHP include() or require() call, enabling inclusion of arbitrary server-local files. Under the right server conditions, this can expose sensitive configuration files such as wp-config.php and escalate to remote code execution through techniques like log poisoning; the CVSS scorer's C:H/I:H/A:H ratings reflect this full-chain potential. No public exploit code has been identified and EPSS probability is 0.08% (23rd percentile), indicating low opportunistic exploitation risk at this time.

Local file inclusion in Militarology WordPress theme versions up to 1.0.15 allows unauthenticated remote attackers to include arbitrary local files, potentially exposing sensitive data and achieving remote code execution. The vulnerability carries a CVSS 3.1 score of 8.1 (high) but EPSS exploitation probability is low (0.08%), with no public exploit or active exploitation reported.

Local file inclusion in AncoraThemes ShieldGroup WordPress theme versions up to 2.13 enables unauthenticated remote attackers to include arbitrary local files. Despite high CVSS severity, EPSS indicates very low real-world exploitation probability; no active exploitation or public exploit code has been identified at time of analysis.

Local file inclusion in the Stockholm Core WordPress plugin (≤2.4.6) allows authenticated users with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation or public exploit code is known at this time, though the low EPSS score indicates limited real-world risk despite the high CVSS impact.

Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.

Local File Inclusion in the Hub Core WordPress plugin (LiquidThemes, versions through 5.0.8) allows an authenticated network attacker with low privileges to supply a crafted filename parameter that is passed unsanitized to a PHP include/require statement, enabling inclusion of arbitrary server-side files. Successful exploitation can expose sensitive configuration data (wp-config.php, credentials) or, under favorable server conditions such as log poisoning, escalate to remote code execution and full site compromise. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at 0.08%, reflecting low current exploitation activity.

Local file inclusion in ThemeMove MinimogWP through 3.9.6 lets authenticated low-privilege WordPress users influence a PHP include/require statement (CWE-98), potentially disclosing sensitive local files or, if a local PHP-parseable file can be targeted, escalating to code execution. The flaw is network-reachable but high complexity (AC:H) because success depends on path, wrapper, or target-file conditions the attacker does not fully control; it requires a low-privileged authenticated account (PR:L), needs no user interaction (UI:N), and carries a vendor CVSS base score of 7.5. No public exploit identified at time of analysis.

Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.

Unauthenticated local file inclusion in the Extensive VC Addons for WPBakery page builder plugin affects all versions up to and including 1.9.1, letting remote attackers pass a crafted shortcode_name value to the extensive_vc_init_shortcode_pagination AJAX action so the plugin includes and executes arbitrary PHP files already present on the server. The vulnerability is rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): exploitation is remote with no authentication or user interaction, but the high attack-complexity metric reflects that the attacker must craft a value that both defeats the plugin's insufficient path normalization and resolves to an includable, attacker-reachable PHP file (for example an uploaded media file, temp/session file, or poisoned log), since LFI executes existing files rather than injecting new code. No public exploit code and no CISA KEV entry were identified at the time of analysis.

Local file inclusion in the LT Unleashed plugin for WordPress (all versions up to and including 1.1.1) allows authenticated attackers with Contributor-level access or higher to supply a path-traversal value to the 'template' parameter of the `book` shortcode, causing the server to include and execute arbitrary PHP files. Impact ranges from disclosure of sensitive files such as wp-config.php to full code execution where an attacker-includable PHP file already exists on the host - a staging step the vendor accounts for in its AC:H rating. No public exploit code or CISA KEV entry was identified at time of analysis, and practical exposure is narrow: only sites that grant Contributor accounts to untrusted users, on a plugin with a low deployment footprint, are realistically at risk.