Description Summary:
A critical PHP Object Injection vulnerability exists in the Axiomthemes AI ANN theme, allowing unauthenticated attackers to potentially execute arbitrary code.

Executive Summary:
A critical unauthenticated PHP Object Injection vulnerability in the Axiomthemes AI ANN theme enables remote attackers to compromise the integrity and availability of the affected system.

Vulnerability Details

CVE-ID: CVE-2026-65581

Affected Software: Axiomthemes AI ANN

Affected Versions: n/a through 1.29.0

Vulnerability: This flaw is a result of unsafe deserialization of untrusted data, specifically falling under CWE-502. An unauthenticated attacker can leverage this to inject malicious objects that lead to arbitrary code execution with the privileges of the web server.

Business Impact

The CVSS score of 9.8 underscores the severe potential for total system takeover. Exploitation of this vulnerability could lead to the theft of sensitive proprietary data, unauthorized modification of website content, and the potential for lateral movement into the wider internal network.

Remediation Plan

Immediate Action: Apply the latest security update released by Axiomthemes for the AI ANN theme to address the deserialization vulnerability.

Proactive Monitoring: Monitor web server logs for irregular query strings or POST requests that appear to contain serialized object signatures.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block requests that attempt to exploit PHP deserialization vulnerabilities.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently exploitable by any remote user, making it a high priority for remediation.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency given its critical CVSS rating. Ensure the AI ANN theme is updated to the latest version immediately to close the injection vector and protect against potential remote exploitation.

Description Summary:
An unauthenticated PHP Object Injection vulnerability exists in the axiomthemes Agricola theme, specifically affecting versions 1.21.0 and earlier.

Executive Summary:
A critical unauthenticated PHP Object Injection vulnerability in the axiomthemes Agricola theme allows for potential remote code execution, demanding immediate attention from security teams.

Vulnerability Details

CVE-ID: CVE-2026-65579

Affected Software: axiomthemes Agricola

Affected Versions: n/a through 1.21.0

Vulnerability: The theme fails to properly validate user-supplied input before deserializing it, which is classified as CWE-502. This allows an unauthenticated attacker to pass malicious serialized objects, which can then be used to execute arbitrary code on the server.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to business continuity and data security. An attacker could exploit this flaw to bypass all authentication mechanisms, steal database credentials, or deploy persistent backdoors within the application environment.

Remediation Plan

Immediate Action: Update the Agricola theme to the most recent version provided by axiomthemes to remediate the deserialization flaw.

Proactive Monitoring: Audit application logs for suspicious activity, including requests that attempt to pass serialized data to themes or plugins.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter incoming traffic and block payloads containing serialized PHP objects.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The ability to trigger this without authentication makes the threat highly accessible to attackers.

Analyst Recommendation

The presence of a known proof-of-concept, combined with the critical CVSS severity, necessitates an urgent response. Security teams should ensure that the Agricola theme is updated to a patched version immediately to prevent unauthorized access and potential remote code execution.

Description Summary:
The Axiomthemes A.Williams WordPress theme is vulnerable to unauthenticated PHP object injection, which may allow remote code execution.

Executive Summary:
A critical unauthenticated PHP object injection vulnerability in the Axiomthemes A.Williams theme poses a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-65572

Affected Software: Axiomthemes A.Williams

Affected Versions: <= 1.3.1

Vulnerability: The vulnerability is a PHP object injection flaw (CWE-502) caused by the deserialization of untrusted user input. Because the attack vector is network-based and requires no authentication, an attacker can execute arbitrary code on the underlying server.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to achieve full system compromise. Given the CVSS score of 9.8, the potential impact includes unauthorized access to sensitive data, complete loss of system integrity, and total service disruption.

Remediation Plan

Immediate Action: Update the Axiomthemes A.Williams theme to the latest available version provided by the vendor. If a patch is not yet available, consider disabling the theme until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous requests containing serialized PHP objects or suspicious payloads. Monitor system resource utilization for unexpected spikes that may indicate unauthorized code execution.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common PHP object injection patterns and malicious input strings.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. This flaw is inherently dangerous due to its unauthenticated nature and the potential for remote code execution.

Analyst Recommendation

This vulnerability represents a critical security risk due to its potential for full system compromise without requiring user credentials. Administrators should prioritize updating the affected theme immediately and verify that no unauthorized modifications have been made to the WordPress installation.

Description Summary:
The 69 Clothing WordPress theme is affected by an unauthenticated PHP object injection vulnerability, which enables attackers to execute arbitrary code through the deserialization of untrusted input.

Executive Summary:
A critical PHP object injection vulnerability in the 69 Clothing theme allows unauthenticated attackers to perform remote code execution, threatening the integrity and security of the entire web server.

Vulnerability Details

CVE-ID: CVE-2026-65571

Affected Software: Axiomthemes 69 Clothing

Affected Versions: up to and including 1.2.11.1

Vulnerability: The theme improperly handles deserialization of untrusted data (CWE-502). This flaw allows an unauthenticated attacker to inject malicious PHP objects, which can lead to remote code execution and full application compromise.

Business Impact

The potential impact of this vulnerability is critical, as it allows attackers to bypass authentication and gain full control over the website. This could lead to the theft of customer information, unauthorized site modifications, or the deployment of malware, causing severe damage to the organization's reputation and financial health. The 9.8 CVSS score reflects the extreme risk posed to the confidentiality, integrity, and availability of the affected system.

Remediation Plan

Immediate Action: Update the 69 Clothing theme to the latest version as soon as a security patch is provided by the developer, or consider switching to an alternative, secure theme if a fix is not forthcoming.

Proactive Monitoring: Implement robust logging and review access logs for unusual activity that might signify an attempt to exploit deserialization vulnerabilities.

Compensating Controls: Deploy a Web Application Firewall (WAF) to intercept and block requests that attempt to exploit the deserialization process.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is currently not confirmed as active, the technical nature of the flaw makes it highly susceptible to weaponization.

Analyst Recommendation

Due to the critical severity and the potential for unauthenticated remote code execution, this issue requires urgent attention. Organizations should monitor the vendor for a security update and apply it immediately upon release to secure their infrastructure against potential exploitation.

Description Summary:
A deserialization of untrusted data vulnerability in the axiomthemes 777 WordPress theme allows for PHP object injection.

Executive Summary:
A critical PHP object injection vulnerability in the axiomthemes 777 theme allows unauthenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-57738

Affected Software: axiomthemes 777

Affected Versions: 0 through 1.13.0

Vulnerability: The theme is susceptible to CWE-502 (Deserialization of Untrusted Data), permitting an unauthenticated attacker to supply malicious input that results in arbitrary object injection. This facilitates potential code execution within the WordPress environment.

Business Impact

The CVSS score of 9.8 reflects the high severity of this flaw, which allows for full site takeover and unauthorized access to sensitive application data. The ability for unauthenticated exploitation significantly increases the risk to the organization’s digital assets and reputation.

Remediation Plan

Immediate Action: Update the 777 theme to the latest patched version. If an update is unavailable, ensure the theme is not active on the site until the vendor provides a fix.

Proactive Monitoring: Review security logs for unexpected file modifications or unauthorized administrative actions that could follow a successful injection attack.

Compensating Controls: Utilize a WAF to inspect incoming traffic and filter out requests containing malicious serialized PHP objects.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of this vulnerability makes it a prime candidate for automated exploitation scripts.

Analyst Recommendation

Given the critical nature of this vulnerability, immediate remediation is required to secure the environment. Organizations should prioritize updating the 777 theme and auditing their WordPress installations for any signs of unauthorized activity or persistence.

Description Summary:
The Little Birdies theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the axiomthemes Little Birdies WordPress theme allows unauthenticated attackers to read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28129

Affected Software: axiomthemes Little Birdies

Affected Versions: 0 through 1.3.16

Vulnerability: The theme suffers from a Local File Inclusion (LFI) flaw, categorized as CWE-98. This vulnerability allows an unauthenticated attacker to manipulate file paths to include unauthorized files, potentially resulting in full system compromise.

Business Impact

The exploitation of this vulnerability could lead to the exposure of sensitive configuration files, source code, or internal data, and may facilitate remote code execution. Given the CVSS score of 8.1, this represents a significant security risk that could result in total system compromise and severe reputational damage.

Remediation Plan

Immediate Action: Since no specific patch version is confirmed, users should immediately deactivate or uninstall the Little Birdies theme if it is not business-critical. If the theme must remain in use, monitor vendor channels for the release of version 1.3.17 or higher.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unexpected file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and requests targeting PHP include or require parameters.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit or weaponized code available for this vulnerability).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, it currently lacks evidence of widespread automated exploitation.

Analyst Recommendation

Given the potential for complete system compromise, administrators must prioritize the removal or containment of the Little Birdies theme. Until a verified security update is provided by the vendor, limiting the impact via WAF rules and strict file system permissions is essential to prevent unauthorized access.

Description Summary:
The axiomthemes Nirvana WordPress theme contains a Local File Inclusion vulnerability due to improper filename control in include statements, potentially allowing unauthorized file access.

Executive Summary:
A critical Local File Inclusion vulnerability in the axiomthemes Nirvana WordPress theme could allow unauthenticated attackers to access sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2026-28119

Affected Software: axiomthemes Nirvana

Affected Versions: 0 through 2.6

Vulnerability: This flaw is an Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98), which permits an unauthenticated attacker to perform Local File Inclusion. The vulnerability resides within the theme's handling of include operations, allowing the execution or inclusion of arbitrary local files.

Business Impact

The exploitation of this vulnerability poses a severe risk to organizational security, as it may lead to unauthorized disclosure of sensitive configuration files, source code, or internal data. With a CVSS score of 8.1, the potential for high-impact compromise of confidentiality, integrity, and availability is significant, necessitating urgent remediation to prevent potential system-wide compromise.

Remediation Plan

Immediate Action: There is no official patch currently available; administrators should immediately disable or remove the Nirvana theme until a secure version is released by the vendor.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or requests for sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests targeting the theme directory.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited in the wild, the nature of the flaw makes it a high-value target for automated scanning and exploitation.

Analyst Recommendation

The vulnerability represents a significant security risk due to the potential for unauthorized file access and remote execution. Given the lack of an available patch, organizations must prioritize the immediate deactivation of the affected theme to maintain a secure posture. Ensure that all alternative themes are updated and that the environment is reviewed for signs of previous unauthorized access.

Description Summary:
The Welldone theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames in include or require statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the axiomthemes Welldone WordPress theme could allow an unauthenticated attacker to access sensitive local files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28118

Affected Software: axiomthemes Welldone

Affected Versions: 0 through 2.4

Vulnerability: This vulnerability, classified as CWE-98, occurs when the application fails to properly sanitize user-supplied input used in PHP file inclusion functions. An unauthenticated attacker can leverage this flaw to include unauthorized files, potentially leading to information disclosure or remote code execution.

Business Impact

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected WordPress instance. With a CVSS score of 8.1, the flaw is considered high-severity: successful exploitation can lead to full system compromise, exposing sensitive configuration files, database credentials, or proprietary application logic to unauthorized parties.

Remediation Plan

Immediate Action: Since no specific patch version is confirmed, administrators should immediately deactivate or uninstall the Welldone theme if it is not business-critical. If the theme must remain active, contact the vendor for an urgent security update or search for the latest version that addresses CWE-98.

Proactive Monitoring: Monitor server access logs for suspicious patterns, such as directory traversal attempts (e.g., ../ strings) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious path traversal patterns and unauthorized file inclusion attempts targeted at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is technically severe, the lack of a known exploit reduces the immediate likelihood of mass exploitation.

Analyst Recommendation

The presence of a Local File Inclusion flaw in a WordPress theme represents a critical security oversight that requires immediate attention. Organizations should prioritize updating the Welldone theme to the latest available release or removing it entirely to neutralize the attack surface. Failure to remediate this vulnerability may leave the underlying server infrastructure exposed to unauthorized file access and potential code execution.

Description Summary:
A PHP Local File Inclusion vulnerability in the axiomthemes smart SEO theme allows unauthenticated attackers to manipulate file paths in include statements.

Executive Summary:
The axiomthemes smart SEO theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to read arbitrary files or execute code on the server.

Vulnerability Details

CVE-ID: CVE-2026-28117

Affected Software: axiomthemes smart SEO

Affected Versions: 0 through 2.9

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) occurring due to improper control of filenames used in PHP include or require statements. The flaw is exploitable by an unauthenticated attacker over the network.

Business Impact

Successful exploitation of this vulnerability can result in the unauthorized disclosure of sensitive server files, including configuration files or credentials. Furthermore, depending on the server configuration, this vulnerability may facilitate remote code execution, leading to a total compromise of the application and the underlying host environment. Given the CVSS score of 8.1, this represents a high-severity risk to system confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: As there is no official patch currently confirmed, administrators should immediately deactivate or uninstall the smart SEO theme until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal sequences, such as "../", or requests directed at sensitive system paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion patterns and directory traversal attempts targeting the WordPress environment.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit in the available data).

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability remains a concern due to the nature of PHP file inclusion vulnerabilities, which are frequently targeted in automated attacks.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent unauthorized access or system takeover. Security teams should prioritize the removal of the vulnerable smart SEO theme from production environments until the vendor provides a patched version. Monitoring for indicators of compromise remains critical until the software is updated or replaced.

Description Summary:
The Conquerors theme for WordPress is vulnerable to local file inclusion, allowing unauthenticated attackers to manipulate file paths via improper control of include statements.

Executive Summary:
A critical local file inclusion vulnerability in the AxiomThemes Conquerors WordPress theme allows unauthenticated attackers to access sensitive files or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-28079

Affected Software: AxiomThemes Conquerors

Affected Versions: 0 through 1.2.13

Vulnerability: This vulnerability, categorized as CWE-98, arises from improper control of filenames used in include or require statements. An unauthenticated attacker can supply malicious input to trigger local file inclusion, potentially leading to unauthorized information disclosure or system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high level of risk to the confidentiality, integrity, and availability of the host environment. Successful exploitation could allow an attacker to read sensitive configuration files, capture database credentials, or gain deeper access to the underlying server infrastructure, leading to significant data breaches or service downtime.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or uninstall the Conquerors theme until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal patterns, such as sequences like "../" or null byte injections, targeting theme-related files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) patterns and prevent unauthorized directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires specific conditions, the nature of the flaw makes it a significant target for automated scanners.

Analyst Recommendation

Given the high severity of this file inclusion vulnerability, security teams must prioritize the isolation of any systems running the affected version of the Conquerors theme. If immediate removal is not feasible, implement strict WAF filtering and monitor for anomalous file access patterns until a vendor-supplied patch is confirmed as available and applied.

Description Summary:
The Marveland WordPress theme is susceptible to local file inclusion, allowing unauthenticated attackers to manipulate file paths via improper control of include statements.

Executive Summary:
A critical local file inclusion vulnerability in the AxiomThemes Marveland theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-22370

Affected Software: AxiomThemes Marveland

Affected Versions: 0 through 1.3.0

Vulnerability: This vulnerability is a local file inclusion flaw (CWE-98) stemming from improper control of filenames used in include or require statements. The flaw allows an unauthenticated attacker to supply malicious input to the affected component to access or include unauthorized local files.

Business Impact

The ability to perform local file inclusion presents a severe risk to organizational data and system integrity. An attacker could potentially retrieve sensitive configuration files, credentials, or source code, which may lead to full system compromise or unauthorized access to the underlying WordPress environment. Given the CVSS score of 8.1, this vulnerability is categorized as high severity and requires immediate attention to prevent operational disruption.

Remediation Plan

Immediate Action: Users should audit their environment for the use of the Marveland theme and, if possible, switch to an alternative theme until a vendor-supplied security patch is released.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing path traversal characters like dot-dot-slash sequences or unexpected PHP file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion patterns and directory traversal attempts targeting the WordPress installation.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is inherently dangerous due to the potential for file disclosure, the requirement for specific environmental conditions often limits widespread automated exploitation.

Analyst Recommendation

The vulnerability in the Marveland theme poses a significant security risk to the integrity of the web server. Administrators are urged to prioritize the removal or containment of the affected theme. Applying security updates as soon as they are made available by AxiomThemes is the only definitive method to eliminate this exposure.

Description Summary:
The Redy theme for WordPress is vulnerable to local file inclusion, allowing unauthenticated attackers to manipulate include statements to access sensitive files.

Executive Summary:
A vulnerability in the axiomthemes Redy theme for WordPress allows unauthenticated attackers to perform local file inclusion, posing a significant risk to system confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-22368

Affected Software: axiomthemes Redy

Affected Versions: 0 through 1.0.2

Vulnerability: This is a local file inclusion vulnerability (CWE-98) occurring due to improper control of filenames used in PHP include statements. The flaw is exploitable by an unauthenticated remote attacker who can leverage the vulnerable endpoint to access arbitrary files on the server.

Business Impact

Successful exploitation allows an unauthorized party to read sensitive system files, configuration data, or application source code, potentially leading to full system compromise. With a CVSS score of 8.1, this high-severity vulnerability represents a substantial threat to organizational data security and service availability.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately disable or remove the Redy theme if it is not strictly required for business operations.

Proactive Monitoring: Security teams should review web server access logs for suspicious requests containing path traversal patterns or references to sensitive files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to filter or block incoming requests containing directory traversal sequences or unexpected file inclusion parameters targeting the theme directory.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the lack of authentication requirements makes this a high-priority target for automated scanning and exploitation.

Analyst Recommendation

Given the high severity and the potential for unauthenticated access to sensitive system files, immediate action is required. Organizations utilizing the Redy theme should prioritize either updating to the latest secure version once released by axiomthemes or deactivating the component to eliminate the attack surface entirely.

Description Summary:
The AxiomThemes Jude WordPress theme contains a local file inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the AxiomThemes Jude WordPress theme allows unauthenticated attackers to access sensitive files or potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-22366

Affected Software: AxiomThemes Jude

Affected Versions: 0 through 1.3.0

Vulnerability: This vulnerability, classified as CWE-98, stems from the improper handling of user-supplied input within PHP include or require functions. An unauthenticated attacker can manipulate these parameters to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Business Impact

The exploitation of this vulnerability could lead to a total compromise of the affected WordPress instance. Because the flaw allows for local file inclusion, attackers may read sensitive configuration files, such as wp-config.php, or execute arbitrary PHP code, resulting in full site takeover, data exfiltration, and significant reputational damage. The CVSS score of 8.1 reflects the high severity of the potential impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or disable the Jude theme entirely until a vendor-supplied update is available.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting common PHP include structures.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious PHP inclusion patterns to provide a temporary layer of protection.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation is not currently observed, the technical nature of the flaw makes it highly susceptible to weaponization if the vulnerable endpoint is exposed to the public internet.

Analyst Recommendation

Given the potential for complete system compromise, organizations currently utilizing the AxiomThemes Jude theme must treat this vulnerability with high urgency. Immediately audit your environment for the presence of this theme and implement the recommended compensating controls if a complete removal is not immediately feasible. Prioritize the transition to a secure alternative until the vendor releases a verified security update.

Description Summary:
The SevenTrees theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the AxiomThemes SevenTrees WordPress theme allows unauthenticated attackers to read arbitrary files on the host server.

Vulnerability Details

CVE-ID: CVE-2026-22364

Affected Software: AxiomThemes SevenTrees

Affected Versions: 0 through 1.0.2

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw that permits an unauthenticated attacker to manipulate file paths within the theme, potentially leading to unauthorized disclosure of sensitive server information or code execution. The vulnerability is reachable via the network without requiring user authentication.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting a high potential for impact on confidentiality, integrity, and availability. Successful exploitation allows an attacker to bypass security restrictions to access sensitive configuration files or credentials stored on the server, which could lead to a full compromise of the WordPress installation and the underlying hosting environment.

Remediation Plan

Immediate Action: As no official patch is currently identified, users should immediately deactivate and remove the SevenTrees theme until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal sequences, such as dot-dot-slash patterns, directed at theme files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and detect unauthorized file inclusion requests targeting the WordPress theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The high CVSS score is driven by the potential for total impact on the affected system, necessitating a proactive security posture despite the lack of confirmed exploit activity.

Analyst Recommendation

Given the severity of this file inclusion flaw, administrators must treat this as a critical configuration risk. Immediate deactivation of the vulnerable SevenTrees theme is the most effective way to eliminate the attack surface until the vendor provides a formal security update.

Description Summary:
The Photolia theme for WordPress is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
The axiomthemes Photolia WordPress theme contains a high-severity local file inclusion vulnerability that could allow an unauthenticated attacker to access sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2026-22362

Affected Software: axiomthemes Photolia

Affected Versions: 0 through 1.0.3

Vulnerability: This vulnerability, classified as CWE-98, occurs when the application fails to properly sanitize user-supplied input used in PHP include or require statements. An unauthenticated attacker can exploit this flaw to perform local file inclusion, potentially leading to unauthorized information disclosure or remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the host server. With a CVSS score of 8.1, the flaw is classified as High severity and could allow an attacker to read sensitive configuration files or execute arbitrary PHP code, potentially leading to a full system compromise.

Remediation Plan

Immediate Action: Since no specific patch is currently identified, users should immediately deactivate or uninstall the Photolia theme if it is not business-critical. Monitor vendor channels for the release of a security update and apply it as soon as it becomes available.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or references to sensitive files like wp-config.php. Monitor for anomalous PHP execution patterns that deviate from expected application behavior.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common file inclusion attack patterns and directory traversal attempts. Ensure the underlying server environment is hardened to restrict the web service account from accessing sensitive system files.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the nature of local file inclusion vulnerabilities makes them highly attractive to attackers for reconnaissance and further exploitation.

Analyst Recommendation

Given the High severity of this vulnerability and the potential for complete site takeover, organizations currently running the Photolia theme must treat this as a priority. If the theme cannot be removed, ensure that robust WAF protections are in place and that the application is running with the principle of least privilege to minimize the impact of a potential compromise.

Description Summary:
A deserialization of untrusted data vulnerability in the White Rabbit WordPress theme allows unauthenticated attackers to perform object injection.

Executive Summary:
A critical deserialization vulnerability in the White Rabbit theme allows unauthenticated remote attackers to perform object injection, leading to potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-60226

Affected Software: axiomthemes White Rabbit

Affected Versions: 0 through 1.5.2

Vulnerability: This vulnerability involves the insecure deserialization of untrusted data, which can be exploited by an unauthenticated attacker to inject malicious PHP objects into the application.

Business Impact

Successful exploitation allows for object injection, which can be chained to achieve remote code execution, leading to total system compromise. With a CVSS score of 9.8, this represents the highest level of risk to the confidentiality, integrity, and availability of the affected WordPress site.

Remediation Plan

Immediate Action: As no official patch is currently available, immediately deactivate and remove the White Rabbit theme from your environment until a patched version is released by the vendor.

Proactive Monitoring: Review web server logs for unauthorized attempts to access or manipulate theme-specific files or serialized data streams.

Compensating Controls: Implement a robust Web Application Firewall (WAF) to block known serialization attack patterns; however, deactivation remains the only guaranteed mitigation at this time.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently critical due to the lack of required authentication.

Analyst Recommendation

Because no security update is currently available, the only effective way to mitigate this risk is to discontinue the use of the White Rabbit theme. Administrators should switch to an alternative theme immediately to protect their systems from potential exploitation.

Description Summary:
The Rosalinda WordPress theme is vulnerable to local file inclusion, which may allow an unauthenticated attacker to read arbitrary files on the server through improper filename control.

Executive Summary:
The Rosalinda WordPress theme contains a high-severity local file inclusion vulnerability that could allow an unauthenticated attacker to access sensitive server files.

Vulnerability Details

CVE-ID: CVE-2025-60063

Affected Software: axiomthemes Rosalinda

Affected Versions: 0 through 1.2.3

Vulnerability: This vulnerability is a local file inclusion flaw caused by improper control of filenames in include or require statements. An unauthenticated attacker can leverage this to include arbitrary files, potentially leading to information disclosure or remote code execution.

Business Impact

The ability to include arbitrary files on a web server presents a severe risk, as it allows attackers to bypass authentication and access sensitive configuration files, credentials, or source code. Given the CVSS score of 8.2, this vulnerability carries a high risk of total system compromise. Such an incident could result in significant data breaches, loss of intellectual property, and prolonged operational downtime.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for the Rosalinda theme and update to the latest version if a fix has been released. If no patch is available, consider deactivating or removing the theme until a secure version is provided by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious requests containing directory traversal patterns or unexpected file path inclusions. Review logs for unusual GET or POST requests directed at theme-specific PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal and local file inclusion attempts. Ensure the web server process runs with the least privilege necessary to restrict access to sensitive system files.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the nature of the flaw makes it a high-value target for automated scanning tools.

Analyst Recommendation

This vulnerability represents a significant security risk to any environment running the Rosalinda theme. Administrators should prioritize checking the vendor's repository for updates immediately. If an update is not yet available, the theme should be considered insecure and removed from production environments to prevent potential unauthorized access.

Description Summary:
The Panda theme for WordPress is vulnerable to Local File Inclusion, allowing unauthenticated attackers to manipulate file paths and potentially include arbitrary local files.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the axiomthemes Panda WordPress theme allows unauthenticated attackers to compromise sensitive files or execute unauthorized code.

Vulnerability Details

CVE-ID: CVE-2025-60050

Affected Software: axiomthemes Panda

Affected Versions: 0 through 1.21

Vulnerability: The vulnerability stems from improper control of filenames used in include or require statements, which facilitates Local File Inclusion (LFI). This flaw is exploitable by unauthenticated remote attackers who can manipulate input to access or execute arbitrary files on the server.

Business Impact

Successful exploitation of this vulnerability can lead to full server compromise, unauthorized access to sensitive configuration files, and potential remote code execution. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality, integrity, and system availability. Organizations should treat this as a high-priority threat that could lead to widespread service disruption or data breaches.

Remediation Plan

Immediate Action: Check the official Patchstack advisory or the WordPress dashboard for theme updates; if a patch is not yet available, immediately deactivate or uninstall the Panda theme.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules to block requests containing path traversal sequences or attempts to access unauthorized local files.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in the available data.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While currently unexploited, the LFI nature of this flaw makes it inherently dangerous, and it should be remediated as soon as a vendor patch is released.

Analyst Recommendation

This vulnerability presents a severe risk to any WordPress instance utilizing the Panda theme. Administrators must verify if their environment is running version 1.21 or earlier and prioritize the removal of this theme until a secure update is verified as available. Continuous monitoring of server logs is essential until the vulnerability is fully addressed through patching or removal.

Description Summary:
The Soleil WordPress theme by axiomthemes contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
The Soleil WordPress theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to access or execute arbitrary files on the host server.

Vulnerability Details

CVE-ID: CVE-2025-60049

Affected Software: axiomthemes Soleil

Affected Versions: 0 through 1.17

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw that occurs when user-supplied input is improperly handled in include or require statements. The vulnerability is accessible to unauthenticated attackers over the network.

Business Impact

Successful exploitation of this vulnerability allows an attacker to read sensitive files on the server or potentially achieve remote code execution, depending on the server configuration. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and significant operational downtime.

Remediation Plan

Immediate Action: As no specific patch version is currently confirmed, administrators should check the vendor website for the latest theme release and apply updates immediately. If an update is not available, consider switching to an alternative theme until a fix is provided.

Proactive Monitoring: Monitor server access logs for unusual patterns, such as directory traversal characters or attempts to access system files like wp-config.php or /etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion requests.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically reachable via the network, the requirement for specific file path manipulation often necessitates reconnaissance before successful exploitation.

Analyst Recommendation

This vulnerability presents a significant risk to the integrity and availability of the affected WordPress environment. Organizations using the Soleil theme should prioritize auditing their installations and implementing restrictive file system permissions as a temporary defense. Immediate action is required to monitor for indicators of compromise until a vendor-supplied update is verified and installed.

Description Summary:
The Athos WordPress theme by axiomthemes is vulnerable to local file inclusion due to improper control of filenames used in include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the Athos theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-58947

Affected Software: axiomthemes Athos

Affected Versions: 0 through 1.9

Vulnerability: This is a local file inclusion vulnerability (CWE-98) where an unauthenticated attacker can manipulate input to include local files, potentially leading to unauthorized data access or system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.2, reflecting a high potential for impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to read configuration files, access sensitive database credentials, or achieve remote code execution, which may lead to total system compromise and significant reputational damage.

Remediation Plan

Immediate Action: Since a specific patch is not yet confirmed, administrators should immediately disable the Athos theme if possible or restrict access to the web directory until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs for suspicious patterns, such as directory traversal attempts or requests containing unusual file paths and PHP execution indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and local file inclusion attempts targeting PHP include functions.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the current exploit status is unknown, the nature of the flaw makes it a high-priority risk that necessitates immediate defensive measures.

Analyst Recommendation

Given the high severity of this local file inclusion vulnerability, organizations using the Athos theme must treat this as a critical security priority. Regularly monitor the Patchstack vulnerability database for the release of an official security patch and apply it as soon as it becomes available to remediate the underlying flaw.

Description Summary:
The axiomthemes Vocal WordPress theme is susceptible to a local file inclusion vulnerability via improper control of filenames used in include statements.

Executive Summary:
A critical local file inclusion vulnerability in the axiomthemes Vocal theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

Vulnerability Details

CVE-ID: CVE-2025-58946

Affected Software: axiomthemes Vocal

Affected Versions: 0 through 1.12

Vulnerability: The theme fails to properly sanitize input before using it in file inclusion functions, allowing an unauthenticated attacker to perform local file inclusion. This flaw stems from improper control of filenames for include or require statements within the PHP code.

Business Impact

Successful exploitation of this vulnerability can lead to full server compromise, as local file inclusion often allows attackers to read sensitive configuration files or execute arbitrary PHP code on the underlying server. Given the CVSS score of 8.2, this represents a high-severity risk that could result in unauthorized data access, complete system compromise, and significant reputational damage.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate the Vocal theme if it is not business-critical or implement strict file system permissions to limit the scope of potential file access.

Proactive Monitoring: Monitor web server logs for suspicious requests containing directory traversal sequences or attempts to include unexpected system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and local file inclusion attempts targeting the theme directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for unauthenticated remote code execution.

Analyst Recommendation

This vulnerability poses a significant risk to the integrity and confidentiality of the host environment. Administrators are urged to prioritize the removal or mitigation of the affected theme until a formal security update is provided by the vendor. Continue to monitor official vendor channels for the release of a patched version.

Description Summary:
The EcoGrow WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
The axiomthemes EcoGrow WordPress theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-58945

Affected Software: axiomthemes EcoGrow

Affected Versions: 0 through 1.7

Vulnerability: This vulnerability is a Local File Inclusion (CWE-98) flaw that occurs when user-supplied input is improperly sanitized before being passed to a PHP include or require function. An unauthenticated attacker can exploit this to include arbitrary files from the server filesystem.

Business Impact

A successful exploit of this vulnerability could lead to the exposure of sensitive configuration files, database credentials, or other proprietary system data. Given the CVSS score of 8.2, the risk is high as it facilitates unauthorized access to the application environment, potentially resulting in full system compromise and significant reputational damage.

Remediation Plan

Immediate Action: Since a specific patch is not currently confirmed, administrators should immediately deactivate or uninstall the EcoGrow theme if it is not business-critical. If the theme must remain active, ensure strict file permissions and restrict access to the web server directory.

Proactive Monitoring: Monitor server access logs for suspicious patterns involving directory traversal sequences (such as ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block Local File Inclusion attempts and path traversal signatures.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the nature of the flaw makes it a highly attractive target for automated scanning and exploitation.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention from security teams managing WordPress environments. Because the issue allows an unauthenticated actor to interact with the underlying filesystem, the risk to confidentiality and integrity is substantial. Until the vendor releases a secure version, prioritize the isolation of affected systems and the implementation of robust WAF protections to prevent exploitation.

Description Summary:
The Manufactory theme for WordPress is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the axiomthemes Manufactory theme exposes the host system to unauthorized file access and potential code execution.

Vulnerability Details

CVE-ID: CVE-2025-58944

Affected Software: axiomthemes Manufactory

Affected Versions: 0 through 1.4

Vulnerability: This flaw is classified as a CWE-98 vulnerability, where improper validation of user-supplied input allows an attacker to influence file paths used in PHP include or require functions. The vulnerability is accessible to unauthenticated attackers over the network.

Business Impact

The ability to perform local file inclusion can lead to the exposure of sensitive configuration files, such as database credentials or environment variables, resulting in complete system compromise. Given the CVSS score of 8.2, this vulnerability represents a significant risk to data confidentiality and integrity, potentially facilitating further lateral movement within the network.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for any available security updates or patches for the Manufactory theme and apply them immediately. If no patch is currently available, consider switching to an alternative theme until a vendor fix is released.

Proactive Monitoring: Monitor web server access logs for suspicious requests containing directory traversal patterns, such as sequences of dot-dot-slash (../), which are indicative of exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing directory traversal sequences or unexpected file path inclusions directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation is not currently confirmed, the nature of local file inclusion vulnerabilities makes them highly dangerous if a reachable endpoint is identified.

Analyst Recommendation

The vulnerability in the Manufactory theme poses a severe risk to WordPress installations. Administrators must verify their theme version and prioritize applying any updates provided by the vendor. In the absence of a confirmed patch, restricting access to the site or implementing robust WAF rules is necessary to prevent potential unauthorized access to sensitive system files.

Description Summary:
The Agricola WordPress theme contains a local file inclusion vulnerability via improper control of filename inputs in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the axiomthemes Agricola theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-58943

Affected Software: axiomthemes Agricola

Affected Versions: 0 through 1.1.0

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw, categorized as CWE-98, which occurs when user-supplied input is insufficiently validated before being used in a PHP include or require statement. An unauthenticated attacker can manipulate these parameters to access or process unauthorized files on the web server.

Business Impact

The exploitation of this flaw poses a severe risk to organizational security, as it can lead to the exposure of sensitive configuration files, database credentials, or source code. Given the CVSS score of 8.2, this vulnerability is classified as High severity, representing a significant risk of full system compromise and unauthorized data access if left unpatched.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should monitor the official Patchstack vulnerability database and the vendor website for the release of an updated theme version. If no update is available, consider switching to an alternative, supported theme.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or requests for sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and requests containing malicious include parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a verified exploit reduces immediate pressure, the nature of LFI flaws makes them highly attractive for automated scanning and mass exploitation attempts.

Analyst Recommendation

Given the potential for complete system compromise via unauthorized file access, administrators must prioritize the remediation of this vulnerability. Organizations using the Agricola theme should audit their web environment for the presence of the affected versions and implement strict WAF filtering until a vendor-supplied security update is confirmed and applied.

Description Summary:
The Dwell theme for WordPress is vulnerable to local file inclusion, allowing an unauthenticated attacker to manipulate file paths and potentially execute arbitrary PHP code via include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the axiomthemes Dwell theme exposes sites to potential remote code execution and unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2025-58942

Affected Software: axiomthemes Dwell

Affected Versions: 0 through 1.7.0

Vulnerability: This flaw is classified as CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program. The vulnerability allows an unauthenticated attacker to inject malicious file paths, resulting in local file inclusion that can lead to total system compromise.

Business Impact

The vulnerability carries a CVSS score of 8.2, reflecting its potential for total impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to read sensitive configuration files, compromise database credentials, or execute arbitrary code on the underlying web server, leading to significant reputational damage and operational downtime.

Remediation Plan

Immediate Action: Since no specific patch version is currently confirmed, administrators should monitor the vendor advisory for updates and consider temporarily deactivating the Dwell theme if immediate mitigation is required.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences, such as dot-dot-slash patterns, directed toward the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack strings and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of an exploit reduces immediate urgency, the nature of local file inclusion vulnerabilities makes this an attractive target for automated scanning tools.

Analyst Recommendation

Given the high CVSS score and the potential for full system compromise, this vulnerability poses a substantial risk to any organization utilizing the Dwell theme. Administrators must prioritize vigilance and move to update the software as soon as the vendor releases a security patch to address the underlying file inclusion mechanism.

Description Summary:
The Fabric theme for WordPress is vulnerable to local file inclusion due to improper filename control in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the axiomthemes Fabric theme allows unauthenticated attackers to potentially read sensitive files or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-58941

Affected Software: axiomthemes Fabric

Affected Versions: 0 through 1.5.0

Vulnerability: This vulnerability, categorized as CWE-98, arises from insecure handling of filenames in PHP include or require statements. An unauthenticated attacker can manipulate input parameters to include arbitrary local files on the server.

Business Impact

Successful exploitation of this flaw can result in the exposure of sensitive configuration files, database credentials, or source code. With a CVSS score of 8.2, this high-severity vulnerability poses a significant risk of full system compromise, data theft, and potential unauthorized execution of malicious code, which could lead to severe operational disruption and reputational damage.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for the availability of a security update and apply it immediately to version 1.5.0 or later. If no patch is available, consider switching to an alternative theme until a vendor-supplied fix is released.

Proactive Monitoring: Monitor server access logs for anomalous requests containing directory traversal patterns or unexpected file paths in URL parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and suspicious file inclusion patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires specific conditions, the nature of local file inclusion makes this an attractive target for automated scanning and manual exploitation attempts.

Analyst Recommendation

Given the potential for high-impact compromise, administrators should prioritize the remediation of this vulnerability. Organizations using the Fabric theme must check the vendor documentation for updates and apply them as soon as they are made available to prevent unauthorized access to the underlying server environment.

Description Summary:
The Basil theme for WordPress is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the axiomthemes Basil WordPress theme could allow an unauthenticated attacker to access or execute arbitrary files on the host server.

Vulnerability Details

CVE-ID: CVE-2025-58940

Affected Software: axiomthemes Basil

Affected Versions: 0 through 1.3.12

Vulnerability: This flaw is classified as CWE-98, involving improper control of filenames for include or require statements. An unauthenticated attacker can exploit this via the network to achieve high confidentiality, integrity, and availability impact.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive server files, including configuration files or credentials. Given the CVSS score of 8.2, this represents a high risk to business operations, as it could lead to full system compromise, data breaches, and potential remote code execution depending on the server configuration.

Remediation Plan

Immediate Action: Monitor for official security updates from axiomthemes and apply the patch as soon as it becomes available. If no update is provided, consider switching to a different theme or disabling the Basil theme entirely to prevent exploitation.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences or unexpected file inclusions. Monitor for unusual system-level activity that may indicate an attacker is attempting to read sensitive PHP or configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block malicious requests that attempt to pass directory traversal payloads or arbitrary file paths to the application.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation is technically feasible, no confirmed weaponized exploits have been identified in the available data.

Analyst Recommendation

The severity of this vulnerability, combined with the potential for unauthorized file access, necessitates immediate attention. Security teams should prioritize checking for vendor updates and implement restrictive file system permissions to limit the scope of potential damage until a formal patch is applied.

Description Summary:
The Prisma WordPress theme contains a local file inclusion vulnerability, allowing unauthenticated attackers to manipulate file paths in include statements to read sensitive server files.

Executive Summary:
A critical local file inclusion vulnerability in the axiomthemes Prisma theme for WordPress allows unauthenticated attackers to potentially read sensitive system files.

Vulnerability Details

CVE-ID: CVE-2025-58932

Affected Software: axiomthemes Prisma

Affected Versions: 0 through 1.10

Vulnerability: The vulnerability, classified as CWE-98, involves improper control of filenames in PHP include statements. This flaw enables an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized data access or code execution.

Business Impact

Successful exploitation of this vulnerability can lead to the exposure of sensitive configuration files, database credentials, or other critical internal data stored on the web server. Given the CVSS score of 8.2, this represents a high-risk security gap that could result in full system compromise and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately switch to a different, secure theme or disable the Prisma theme until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences, such as "../", directed at the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) patterns and path traversal attempts targeting PHP applications.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication, which lowers the barrier for automated discovery and exploitation attempts.

Analyst Recommendation

The severity of this local file inclusion vulnerability necessitates immediate action to protect the integrity and confidentiality of the affected web server. Organizations using the Prisma theme must prioritize moving to a supported, patched version once available or removing the vulnerable component entirely to eliminate the attack surface.

Description Summary:
The Palatio WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
The axiomthemes Palatio theme is susceptible to a Local File Inclusion vulnerability that allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-58931

Affected Software: axiomthemes Palatio

Affected Versions: 0 through 1.6

Vulnerability: The vulnerability is identified as a PHP Local File Inclusion (CWE-98), stemming from insecure handling of input used in include or require statements. An unauthenticated attacker can leverage this flaw to access or process unintended files on the server.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host environment. By gaining the ability to include arbitrary local files, an attacker could potentially extract sensitive configuration data or execute malicious code, leading to a full system compromise. With a CVSS score of 8.2, this high-severity flaw requires immediate attention to prevent unauthorized access to the application and underlying server infrastructure.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified, users should contact the vendor or monitor the official Patchstack advisory for the release of a security update. If an update is unavailable, consider switching to an alternative theme until the vulnerability is addressed by the developer.

Proactive Monitoring: Review web server access logs for anomalous requests containing path traversal sequences or unexpected file extensions in URL parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing directory traversal patterns or suspicious file inclusion attempts directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for specific input handling, but the potential impact remains significant.

Analyst Recommendation

Given the high CVSS score and the nature of Local File Inclusion vulnerabilities, organizations utilizing the Palatio theme should prioritize mitigating this risk. Administrators should audit their current theme version and restrict file access permissions where possible while awaiting a vendor-supplied security update to address the underlying code flaw.

Description Summary:
The FitFlex theme for WordPress is vulnerable to local file inclusion due to improper control of filenames used in PHP include statements.

Executive Summary:
The FitFlex WordPress theme contains a critical local file inclusion vulnerability that could allow an unauthenticated attacker to access or execute arbitrary files on the server.

Vulnerability Details

CVE-ID: CVE-2025-58930

Affected Software: axiomthemes FitFlex

Affected Versions: 0 through 1.6

Vulnerability: This is a local file inclusion vulnerability (CWE-98) where an unauthenticated attacker can manipulate input parameters to include unauthorized PHP files on the server.

Business Impact

Successful exploitation of this flaw poses a severe risk to the confidentiality, integrity, and availability of the host environment. By including arbitrary files, an attacker could potentially read sensitive configuration data or execute malicious code, leading to full site compromise and potential lateral movement within the network. With a CVSS score of 8.2, this vulnerability is categorized as high severity and requires immediate attention to prevent unauthorized system access.

Remediation Plan

Immediate Action: Check the official WordPress repository or the vendor website for a security update that addresses this file inclusion flaw, and update the FitFlex theme immediately. If no patch is currently available, consider switching to an alternative theme until a vendor-supplied fix is released.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block common file inclusion patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it allows attackers to bypass standard application logic to interact with the underlying file system.

Analyst Recommendation

Given the potential for complete system compromise, administrators should prioritize the remediation of this vulnerability. If an official update is not yet available, the most effective mitigation is to deactivate the vulnerable theme until the vendor provides a secure version. Organizations should treat this as a high-priority task to prevent potential exploitation of their web infrastructure.

Description Summary:
The Pantry theme for WordPress contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A critical Local File Inclusion vulnerability in the axiomthemes Pantry theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-58929

Affected Software: axiomthemes Pantry

Affected Versions: 0 through 1.4

Vulnerability: This vulnerability is classified as CWE-98, involving improper control of filenames in PHP include or require statements. The flaw permits an unauthenticated attacker to perform Local File Inclusion, which can lead to unauthorized file access or code execution.

Business Impact

The ability to include arbitrary local files poses a severe risk to the confidentiality, integrity, and availability of the WordPress environment. An attacker could leverage this flaw to read configuration files, such as wp-config.php, or execute malicious code, leading to full site compromise. With a CVSS score of 8.2, this vulnerability is classified as High severity and requires immediate attention to prevent data theft or service disruption.

Remediation Plan

Immediate Action: Since no patch is currently confirmed, administrators should immediately deactivate or uninstall the Pantry theme if it is not strictly required for site operations.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing directory traversal sequences or attempts to access system files like etc/passwd.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts to minimize the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the current exploitation risk is not confirmed, the nature of Local File Inclusion flaws makes them highly attractive targets for automated scanning and exploitation.

Analyst Recommendation

Given the high CVSS severity and the potential for full system compromise, organizations currently using the axiomthemes Pantry theme must treat this vulnerability with high urgency. If an update from the vendor becomes available, it should be applied immediately after testing. In the absence of a patch, removing the vulnerable software is the only reliable method to eliminate this risk.

Description Summary:
The Good Mood theme for WordPress is vulnerable to local file inclusion, allowing unauthenticated attackers to manipulate file paths in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the axiomthemes Good Mood WordPress theme poses a significant risk of unauthorized file access and potential code execution.

Vulnerability Details

CVE-ID: CVE-2025-58894

Affected Software: axiomthemes Good Mood

Affected Versions: 0 through 1.16

Vulnerability: This flaw stems from improper control of filenames used in PHP include or require statements, categorized as CWE-98. The vulnerability allows an unauthenticated attacker to include local files on the server, potentially leading to information disclosure or further compromise.

Business Impact

The vulnerability carries a CVSS score of 8.2, reflecting a high level of risk to the confidentiality, integrity, and availability of the affected system. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary code on the hosting server, leading to full site compromise and significant data leakage.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for the latest security release and update the Good Mood theme to the version that resolves this issue. If a patch is not yet available, consider temporarily switching to a different theme to maintain site security.

Proactive Monitoring: Monitor web server access logs for anomalous requests containing directory traversal sequences or attempts to access system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion (LFI) patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the risk is high, the requirement for specific environmental conditions often associated with LFI vulnerabilities may limit immediate exploitation attempts.

Analyst Recommendation

Given the high CVSS severity and the potential for full system compromise, administrators should prioritize this update. Until a verified fix is applied, ensure the WordPress installation is hardened, file permissions are restricted, and unnecessary plugins or themes are removed to reduce the overall attack surface.

Description Summary:
The Alright WordPress theme is vulnerable to local file inclusion, allowing unauthenticated attackers to include arbitrary files via improper filename control in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the axiomthemes Alright theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-58893

Affected Software: axiomthemes Alright

Affected Versions: 0 through 1.6.1

Vulnerability: This is a local file inclusion vulnerability (CWE-98) resulting from improper control of filenames in PHP include or require statements. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

Successful exploitation permits an attacker to read sensitive files from the underlying server, including configuration files, credentials, or source code. Given the CVSS score of 8.2, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and significant operational disruption.

Remediation Plan

Immediate Action: Check the official WordPress theme repository or the vendor website for security updates beyond version 1.6.1, and apply them immediately. If no update is available, consider switching to a different theme until a patched version is released.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and directory traversal attempts.

Exploitation Status

Public Exploit Available: No — exploit_available is unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's exploitability is inherent to the lack of input validation on file inclusion paths within the theme code.

Analyst Recommendation

The vulnerability poses a significant risk to the integrity and confidentiality of the host environment. Administrators are advised to prioritize the identification and removal of the vulnerable theme or the application of the vendor patch, if available, to prevent potential unauthorized access.

Description Summary:
The Towny WordPress theme contains a PHP Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
The axiomthemes Towny WordPress theme is vulnerable to Local File Inclusion, which could allow an unauthenticated attacker to read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-58889

Affected Software: axiomthemes Towny

Affected Versions: 0 through 1.16

Vulnerability: This vulnerability is caused by improper handling of user-supplied input in include or require statements, allowing an unauthenticated attacker to perform Local File Inclusion (LFI). By manipulating the filename parameter, an attacker can force the application to include unintended files stored on the local file system.

Business Impact

A successful exploit of this vulnerability could lead to full system compromise, including the exposure of sensitive configuration files, database credentials, or source code. Given the CVSS score of 8.2, this represents a high-severity risk that could result in unauthorized data access or total service disruption if leveraged for remote code execution.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate or remove the affected Towny theme until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs for requests containing path traversal patterns or suspicious file inclusion attempts, such as references to etc/passwd or wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI payloads and directory traversal characters.

Exploitation Status

Public Exploit Available: No.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is not currently being exploited in the wild, the lack of a known patch makes immediate deactivation of the theme the most effective risk mitigation strategy.

Analyst Recommendation

Due to the high-severity nature of this Local File Inclusion flaw and the potential for complete system compromise, security teams must treat this as a critical priority. Please audit all WordPress installations for the presence of the Towny theme and ensure it is disabled until the vendor provides a verified security update to remediate the underlying code flaw.

Description Summary:
The Algenix theme for WordPress is vulnerable to local file inclusion due to improper control of filenames in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the axiomthemes Algenix theme allows unauthenticated attackers to potentially read sensitive files or achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-58803

Affected Software: axiomthemes Algenix

Affected Versions: 0 through 1.0

Vulnerability: This vulnerability, classified as CWE-98, occurs when the software improperly handles user-supplied input within PHP include or require statements. An unauthenticated attacker can leverage this flaw to include local files, leading to unauthorized data disclosure or potential system compromise.

Business Impact

The ability to perform local file inclusion poses a severe threat to business operations, as it may allow attackers to access sensitive configuration files or source code. Given the CVSS score of 8.2, this vulnerability is classified as High severity. Successful exploitation could lead to full system compromise, resulting in significant data breaches and prolonged service downtime.

Remediation Plan

Immediate Action: Since a patch is currently unknown, administrators should immediately disable or remove the Algenix theme from their WordPress environment until a secure version is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file path inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion attack patterns and unauthorized directory access attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The high CVSS score is driven by the potential for total technical impact, though the attack complexity is noted as high.

Analyst Recommendation

Given the potential for complete system compromise via local file inclusion, this vulnerability must be treated with high priority. Users are strongly advised to deactivate the Algenix theme immediately and monitor the vendor’s security database for the release of a definitive patch. Maintaining a hardened server configuration remains the most effective defense against this category of PHP-based vulnerabilities.

Description Summary:
The Hygia WordPress theme is susceptible to local file inclusion due to improper sanitization of filenames used in PHP include statements.

Executive Summary:
The Hygia WordPress theme contains a high-severity local file inclusion vulnerability that could allow an unauthenticated attacker to access sensitive server files.

Vulnerability Details

CVE-ID: CVE-2025-53453

Affected Software: axiomthemes Hygia

Affected Versions: 0 through 1.16

Vulnerability: This vulnerability, categorized as CWE-98, involves improper control of filenames during PHP include or require operations. The flaw allows an unauthenticated attacker to perform local file inclusion, potentially leading to unauthorized data disclosure or arbitrary code execution.

Business Impact

The CVSS score of 8.2 reflects a high degree of risk, as this vulnerability provides a vector for unauthenticated attackers to read sensitive configuration files or execute malicious PHP scripts on the underlying server. Successful exploitation can result in full site compromise, loss of customer data, and significant reputational damage.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately audit the theme configuration or consider switching to a secure alternative until the vendor releases a verified update.

Proactive Monitoring: Monitor server access logs for anomalous requests containing directory traversal patterns, such as sequences of dot-dot-slash (../), directed at PHP files within the theme directory.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to inspect and block incoming HTTP requests that attempt to pass file paths or directory traversal sequences to theme-related parameters.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit in the available data).

Analyst Notes: As of December 19, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for unauthenticated remote file inclusion, necessitating immediate defensive measures even in the absence of known active exploitation.

Analyst Recommendation

Given the high CVSS score and the nature of local file inclusion vulnerabilities, this issue represents a significant risk to the integrity and confidentiality of the host environment. Administrators must prioritize the containment of this threat by implementing WAF protections and closely monitoring system logs for signs of unauthorized access until a formal vendor patch is confirmed and applied.

Description Summary:
The smart SEO plugin for WordPress contains an incorrect privilege assignment vulnerability, allowing unauthenticated attackers to perform privilege escalation.

Executive Summary:
A critical privilege escalation vulnerability in the axiomthemes smart SEO plugin allows unauthenticated attackers to gain elevated administrative access.

Vulnerability Details

CVE-ID: CVE-2025-49401

Affected Software: axiomthemes smart SEO

Affected Versions: 0 through 4.0

Vulnerability: This vulnerability is classified as an Incorrect Privilege Assignment (CWE-266). It permits an unauthenticated attacker to manipulate user roles or permissions, effectively bypassing intended security controls to escalate their account privileges.

Business Impact

Successful exploitation of this flaw grants an attacker full administrative control over the affected WordPress instance. This risk leads to total system compromise, including unauthorized data access, the injection of malicious content, and potential full site takeover. Given the CVSS score of 9.8, this vulnerability represents an extreme risk to organizational security and data integrity.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified in the provided data, administrators should immediately disable or remove the smart SEO plugin until an official update is released by the vendor.

Proactive Monitoring: Review user account creation logs and audit administrative privilege changes for any unauthorized modifications or suspicious new administrator accounts.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block suspicious requests targeting plugin authentication or role management endpoints.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of September 5, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the unauthenticated nature of the attack vector, which allows for remote, automated exploitation.

Analyst Recommendation

The severity of this privilege escalation vulnerability necessitates immediate action to prevent unauthorized access. Administrators must prioritize the decommissioning of the vulnerable smart SEO plugin until the vendor provides a secure, patched version. Failure to act leaves the environment exposed to total administrative takeover by remote, unauthenticated actors.