Description Summary:
The Elated-Themes Mane WordPress theme contains a Local File Inclusion vulnerability, enabling unauthenticated attackers to potentially read or execute arbitrary files on the underlying web server.

Executive Summary:
A high-severity Local File Inclusion flaw in the Elated-Themes Mane WordPress theme creates a significant risk of unauthorized server access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-78478

Affected Software: Elated-Themes Mane

Affected Versions: 0 through 1.7

Vulnerability: The vulnerability stems from improper input validation during file inclusion processes, allowing an unauthenticated attacker to inject malicious file paths. This flaw enables the attacker to manipulate the file system interactions of the application.

Business Impact

Successful exploitation allows an attacker to bypass authentication and access sensitive files on the host server, leading to potential data theft or full system compromise. With a CVSS score of 8.1, this vulnerability poses a high risk to organizational security, potentially leading to service disruption and the exposure of proprietary information.

Remediation Plan

Immediate Action: Review all WordPress installations for the Mane theme and update to the latest patched version immediately.

Proactive Monitoring: Monitor server logs for unusual file access patterns or attempts to access configuration files that should not be exposed to the web directory.

Compensating Controls: Utilize a Web Application Firewall to filter incoming HTTP requests and block attempts to traverse directories or include unauthorized local files.

Exploitation Status

Public Exploit Available: No confirmed public exploit exists in our curated sources.

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous, as LFI flaws are frequently targeted for initial access.

Analyst Recommendation

Security teams must treat this vulnerability with high priority due to the potential for total system compromise. Ensure that all plugins and themes are regularly updated and that unnecessary themes are removed from the production environment to reduce the attack surface.

Description Summary:
The Verdure Core WordPress plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read or execute arbitrary files.

Executive Summary:
An unauthenticated local file inclusion vulnerability in the Verdure Core WordPress plugin, rated 8.1 on the CVSS scale, introduces a severe risk of unauthorized file access and code execution.

Vulnerability Details

CVE-ID: CVE-2026-66671

Affected Software: Elated-Themes Verdure Core

Affected Versions: All versions through 1.2

Vulnerability: This vulnerability occurs due to improper input validation in file inclusion functions, which allows an unauthenticated attacker to point the application to unauthorized local files.

Business Impact

The ability for an unauthenticated attacker to include arbitrary files can lead to the exposure of sensitive configuration files or the execution of malicious scripts. This level of access poses a severe threat to the integrity and confidentiality of the entire WordPress environment, necessitating immediate remediation.

Remediation Plan

Immediate Action: Discontinue use of the vulnerable plugin until a patch is available, or restrict access to the affected site components.

Proactive Monitoring: Monitor server logs for unauthorized access attempts or suspicious file path traversal patterns directed at the plugin directory.

Compensating Controls: Utilize a Web Application Firewall to filter and block requests that attempt to traverse directories or include non-intended local files.

Exploitation Status

Public Exploit Available: No (unknown)

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw makes it highly attractive for automated exploitation attempts against WordPress sites.

Analyst Recommendation

Because this vulnerability allows for unauthenticated access to system files, it represents a critical security risk. Administrators should immediately audit their use of the Verdure Core plugin and implement the necessary updates or security controls to protect the application environment.

Description Summary:
The Elated-Themes Måne WordPress theme contains an unauthenticated local file inclusion vulnerability that permits unauthorized file access.

Executive Summary:
An unauthenticated local file inclusion flaw in the Elated-Themes Måne WordPress theme creates a significant security risk for the underlying web server.

Vulnerability Details

CVE-ID: CVE-2026-66670

Affected Software: Elated-Themes Måne

Affected Versions: Through 1.7

Vulnerability: The theme suffers from improper control of filenames in PHP include statements, which allows an unauthenticated attacker to include and potentially execute arbitrary local files on the server.

Business Impact

With a CVSS score of 8.1, this vulnerability represents a severe threat to the security of the host system. If exploited, an attacker could read sensitive system files, configuration data, or achieve remote code execution, leading to total system compromise and potential data breach.

Remediation Plan

Immediate Action: Check the vendor website for the latest version and apply the patch as soon as it becomes available. If no patch exists, consider deactivating the theme until a fix is released.

Proactive Monitoring: Review web server and application logs for unusual file inclusion patterns or unauthorized access attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out requests that attempt to traverse directories or include unauthorized local files.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The absence of a confirmed patch means the primary defense remains monitoring and compensating controls until the vendor provides a remediation update.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention. Because the flaw allows for unauthenticated file inclusion, administrators should treat this as a high priority and monitor the vendor for a security update to remediate the underlying code flaw.

Description Summary:
The Flow WordPress theme is susceptible to Local File Inclusion (LFI) due to insufficient input validation when handling filenames in include/require statements.

Executive Summary:
A Local File Inclusion vulnerability in the Elated-Themes Flow WordPress theme allows authenticated attackers to potentially compromise the application by accessing or executing arbitrary files.

Vulnerability Details

CVE-ID: CVE-2026-57793

Affected Software: Elated-Themes Flow

Affected Versions: 0 through 1.8

Vulnerability: This vulnerability (CWE-98) allows an authenticated attacker to influence file inclusion operations. This permits the inclusion of unauthorized local files, which can lead to server-side code execution or the disclosure of sensitive application information.

Business Impact

The exploitation of this flaw poses a high risk to business operations, as it can lead to unauthorized data access and total system compromise. The CVSS score of 7.5 highlights the severe impact on the application's security posture and the necessity for immediate defensive action.

Remediation Plan

Immediate Action: As no patch is available, administrators are advised to deactivate the Flow theme to eliminate the attack vector until a secure version is released.

Proactive Monitoring: Review application logs for evidence of directory traversal or unauthorized include attempts, particularly those originating from authenticated user sessions.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious payloads intended to exploit LFI vulnerabilities in the theme's code.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While no exploit is currently confirmed, the vulnerability's impact level necessitates proactive protection.

Analyst Recommendation

Given the high severity of this LFI vulnerability and the current lack of a patch, immediate deactivation of the affected theme is the most effective temporary control. Administrators must monitor for vendor updates and apply them immediately to ensure long-term security.

Description Summary:
An unauthenticated Local File Inclusion (LFI) vulnerability in the Audrey theme allows remote attackers to read arbitrary files from the server's filesystem.

Executive Summary:
A critical Local File Inclusion vulnerability in the Elated-Themes Audrey theme allows unauthenticated attackers to access sensitive server files, threatening overall system integrity.

Vulnerability Details

CVE-ID: CVE-2026-42382

Affected Software: Elated-Themes Audrey

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability consists of a Local File Inclusion (LFI) flaw that can be triggered by unauthenticated users. The vulnerability allows an attacker to access files outside the intended web directory, potentially exposing sensitive application logic or environment variables.

Business Impact

The ability for an unauthenticated user to read arbitrary files presents a significant security risk, including the compromise of sensitive credentials and configuration data. With a CVSS score of 8.1, the potential for unauthorized data disclosure and subsequent escalation of privileges warrants immediate attention to protect business assets.

Remediation Plan

Immediate Action: Update the Audrey theme to the latest version provided by Elated-Themes to patch the underlying file inclusion vulnerability.

Proactive Monitoring: Monitor server logs for suspicious URL patterns, specifically those attempting to navigate the file system using path traversal characters.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests that exhibit signs of path traversal or unauthorized file access attempts.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability represents a high-risk entry point into the server environment. It is imperative that security teams prioritize updating the affected theme to the most recent version to mitigate the risk of unauthorized file access and potential further exploitation.

Description Summary:
The Elated-Themes Laurent WordPress theme is vulnerable to Local File Inclusion due to improper control of filenames used in PHP include statements.

Executive Summary:
A Local File Inclusion vulnerability in the Elated-Themes Laurent WordPress theme allows authenticated attackers to execute arbitrary local files, potentially compromising the host server.

Vulnerability Details

CVE-ID: CVE-2026-24609

Affected Software: Elated-Themes Laurent

Affected Versions: 0 through 3.1

Vulnerability: This flaw exists due to insufficient sanitization of input passed to include or require statements, categorized as CWE-98. The vulnerability requires the attacker to have low-level authenticated access to the target system to trigger the inclusion of sensitive local files.

Business Impact

Successful exploitation allows an attacker to read sensitive files on the server, which may include configuration files, credentials, or source code. Given the CVSS score of 7.5, this high-severity vulnerability poses a significant risk to data confidentiality and integrity, potentially leading to a full compromise of the web application environment.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should check the vendor website for theme updates or contact Elated-Themes support for remediation guidance.

Proactive Monitoring: Review web server access and error logs for suspicious patterns, such as directory traversal sequences or attempts to access files with .php, .config, or .env extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unexpected file inclusion requests directed at the theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of January 25, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is technically accessible, the requirement for authentication limits the immediate attack surface.

Analyst Recommendation

The presence of a Local File Inclusion vulnerability represents a critical security risk for any WordPress site utilizing the Laurent theme. Organizations should prioritize updating the theme as soon as a fix is released by the vendor and, in the interim, enforce strict access controls to limit the number of authenticated users who can interact with the theme settings.

Description Summary:
A local file inclusion vulnerability in the Elated-Themes Laurent Core plugin allows an authenticated attacker to manipulate file paths in include or require statements.

Executive Summary:
The Elated-Themes Laurent Core plugin contains a local file inclusion vulnerability that could allow an authenticated attacker to gain unauthorized access to sensitive files or execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-24608

Affected Software: Elated-Themes Laurent Core

Affected Versions: 0 through 2.4.1

Vulnerability: This vulnerability, categorized as CWE-98, stems from improper control of filenames in PHP include or require statements. It requires the attacker to possess low-level privileges to successfully trigger the inclusion of arbitrary local files.

Business Impact

The ability to perform local file inclusion poses a significant risk to the integrity and confidentiality of the entire WordPress environment. An attacker could leverage this flaw to read sensitive configuration files, such as wp-config.php, potentially leading to full system compromise, unauthorized database access, or further lateral movement within the network infrastructure. With a CVSS score of 7.5, this vulnerability represents a high-severity threat that requires immediate prioritization.

Remediation Plan

Immediate Action: Since a specific patch version is currently not provided, administrators should deactivate or remove the Laurent Core plugin if it is not essential to site functionality.

Proactive Monitoring: Security teams should monitor server access logs for suspicious requests containing path traversal sequences or attempts to access restricted PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal patterns and unauthorized file inclusion attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of January 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for authenticated access limits the attack surface, but the high potential impact necessitates proactive defense.

Analyst Recommendation

Given the potential for complete system compromise, organizations currently running the Laurent Core plugin must treat this vulnerability with high urgency. If an update becomes available from the vendor, it should be applied immediately, and in the interim, the plugin should be disabled to prevent exploitation.

Description Summary:
The Elated-Themes NeoBeat WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the Elated-Themes NeoBeat WordPress theme could allow an unauthenticated attacker to access or execute sensitive files on the server.

Vulnerability Details

CVE-ID: CVE-2026-22511

Affected Software: Elated-Themes NeoBeat

Affected Versions: 0 through 1.2

Vulnerability: The theme fails to properly sanitize input used in PHP include or require statements, enabling a Local File Inclusion (LFI) flaw. This vulnerability is accessible to unauthenticated attackers via the network.

Business Impact

Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web server or execute malicious PHP code. This poses a severe risk of full system compromise, sensitive data exposure, and unauthorized administrative access. With a CVSS score of 8.1, this represents a significant threat to the confidentiality, integrity, and availability of the hosting environment.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately disable or remove the NeoBeat theme if it is not mission-critical. Contact the vendor for the latest security release or monitor the Patchstack database for updates.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and common LFI payloads.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's complexity in the CVSS vector (AC:H) suggests that successful exploitation may require specific server configurations or environmental conditions.

Analyst Recommendation

Given the potential for remote code execution and unauthorized file access, this vulnerability must be treated with high priority. Organizations utilizing the NeoBeat theme should verify their current version and implement restrictive access controls immediately. Until a vendor-supplied patch is confirmed and applied, removing the vulnerable software remains the most effective mitigation strategy.

Description Summary:
The Elated-Themes Gioia WordPress theme contains a Local File Inclusion vulnerability due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the Elated-Themes Gioia theme allows unauthenticated attackers to read sensitive files or execute arbitrary code on the host server.

Vulnerability Details

CVE-ID: CVE-2026-22509

Affected Software: Elated-Themes Gioia

Affected Versions: 0 through 1.4

Vulnerability: This flaw stems from CWE-98, where the application fails to properly sanitize user-supplied input used in PHP include or require operations. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform Local File Inclusion (LFI) poses a severe threat to business operations, as it may lead to the unauthorized disclosure of sensitive configuration files or the execution of malicious scripts. Given the CVSS score of 8.1, this vulnerability represents a significant risk of full system compromise, potentially leading to data breaches and total loss of confidentiality, integrity, and availability for the affected web server.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or remove the Gioia theme if it is not essential for business operations.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and path traversal attempts to provide a virtual patch while waiting for a vendor update.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The high CVSS score reflects the dangerous potential for code execution, even though the exploit requires specific environmental conditions.

Analyst Recommendation

Due to the critical nature of Local File Inclusion vulnerabilities, this issue should be treated with high priority. Organizations using the Gioia theme must restrict access to the affected site or remove the theme until the vendor releases a security update that addresses the input validation flaw.

Description Summary:
The Elated-Themes Amoli WordPress theme is susceptible to a Local File Inclusion vulnerability due to improper filename control in include statements, potentially allowing unauthorized file access.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the Elated-Themes Amoli theme poses a significant risk of unauthorized file access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-22506

Affected Software: Elated-Themes Amoli

Affected Versions: 0 through 1.0

Vulnerability: The theme contains an improper control of filename for include or require statements, categorized as CWE-98. This vulnerability allows an unauthenticated attacker to perform Local File Inclusion, which may lead to the disclosure of sensitive files or execution of arbitrary code depending on the server environment.

Business Impact

Successful exploitation of this vulnerability could lead to the unauthorized exposure of sensitive configuration files, credentials, or source code stored on the web server. Given the CVSS score of 8.1, this flaw represents a significant risk to the confidentiality and integrity of the WordPress installation, potentially facilitating further system compromise or data exfiltration.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should monitor the vendor website for security updates and apply them immediately upon release. If an update remains unavailable, consider switching to a more secure theme or disabling the Amoli theme until a fix is provided.

Proactive Monitoring: Review web server access logs for suspicious patterns, such as directory traversal attempts or requests for sensitive system files (e.g., wp-config.php) via URL parameters.

Compensating Controls: Deploy or update Web Application Firewall rules to block requests containing path traversal sequences or attempts to include unexpected local files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is not currently associated with active exploitation, the nature of Local File Inclusion flaws makes them highly desirable targets for threat actors seeking to pivot into a compromised environment.

Analyst Recommendation

This vulnerability presents a high risk to WordPress environments using the Amoli theme. Security teams should prioritize identifying all instances of the affected software within their infrastructure and implement temporary containment measures, such as WAF filtering, until the vendor releases a definitive security update.

Description Summary:
The Elated-Themes Lella WordPress theme is susceptible to a local file inclusion vulnerability due to improper control of filenames in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the Elated-Themes Lella WordPress theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-22499

Affected Software: Elated-Themes Lella

Affected Versions: 0 through 1.2

Vulnerability: This is a local file inclusion (CWE-98) flaw where the application fails to properly sanitize input used in file inclusion functions. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability to perform local file inclusion poses a severe threat to business operations, as it may allow unauthorized actors to access sensitive configuration files, database credentials, or system source code. With a CVSS score of 8.1, this vulnerability indicates a high potential for total system compromise, which could lead to significant data breaches, loss of customer trust, and extended service downtime.

Remediation Plan

Immediate Action: As no specific patch version is currently identified, administrators should immediately deactivate or remove the Lella theme if it is not business-critical.

Proactive Monitoring: Review web server access logs for requests containing suspicious directory traversal patterns or unexpected file path inclusions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests that include directory traversal sequences or attempt to access sensitive system files via theme parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the lack of a confirmed patch complicates remediation, the nature of local file inclusion in PHP environments makes this a high-risk vector that requires immediate defensive configuration changes.

Analyst Recommendation

Given the high severity of this file inclusion vulnerability, security teams must prioritize the isolation of affected systems. Until a vendor-supplied update is available, removing or disabling the vulnerable Lella theme remains the most effective method to prevent unauthorized access and potential remote code execution.

Description Summary:
The Elated-Themes Laurent theme for WordPress is vulnerable to local file inclusion, allowing unauthenticated attackers to include arbitrary files via improper control of include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the Elated-Themes Laurent WordPress theme allows unauthenticated attackers to access sensitive files or achieve code execution.

Vulnerability Details

CVE-ID: CVE-2026-22498

Affected Software: Elated-Themes Laurent

Affected Versions: 0 through 3.1

Vulnerability: This vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's PHP implementation. An unauthenticated attacker can exploit this via crafted requests to include unauthorized files on the server.

Business Impact

The ability to perform local file inclusion poses a significant risk to organizational data and system integrity. An attacker could potentially read sensitive configuration files, credentials, or source code, which often leads to full system compromise or unauthorized access to backend databases. With a CVSS score of 8.1, this vulnerability is classified as high severity, and it must be addressed promptly to prevent data exfiltration.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate or uninstall the Laurent theme if it is not business-critical. If the theme is required, restrict access to the affected environment and monitor vendor channels for the release of a security update.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns, such as sequences of dot-dot-slash, or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common local file inclusion payloads and directory traversal attempts targeting the WordPress installation.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unconfirmed in the wild, the nature of local file inclusion flaws makes them highly attractive to attackers for reconnaissance and privilege escalation.

Analyst Recommendation

The high CVSS score of 8.1 reflects the severe potential impact of this flaw on WordPress environments. Organizations should prioritize identifying all instances of the Laurent theme and applying strict access controls or removal until the vendor provides a validated security patch.

Description Summary:
The Elated-Themes Gaspard WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the Elated-Themes Gaspard theme exposes the underlying server to potential unauthorized file access and remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-22493

Affected Software: Elated-Themes Gaspard

Affected Versions: 0 through 1.3

Vulnerability: This flaw is classified as a CWE-98 vulnerability, where the application fails to properly sanitize user-supplied input used in PHP include or require statements. An unauthenticated attacker can exploit this to perform local file inclusion, potentially leading to the disclosure of sensitive server files or the execution of arbitrary code.

Business Impact

The exploitation of this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system. With a CVSS score of 8.1, this flaw allows an attacker to bypass standard application access controls, which may lead to total system compromise or the exfiltration of sensitive configuration files and application data.

Remediation Plan

Immediate Action: Review the vendor advisory for any available patches and update the Gaspard theme to the latest secure version immediately. If no patch is currently available, consider switching to an alternative, supported theme until a fix is released.

Proactive Monitoring: Monitor web server access logs for suspicious patterns, such as directory traversal attempts or requests for sensitive system files like wp-config.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to detect and block directory traversal and local file inclusion attempts targeting PHP applications.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 27, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unconfirmed in the wild, the nature of local file inclusion flaws makes them highly dangerous if the underlying server environment is not properly hardened.

Analyst Recommendation

Given the high CVSS score and the potential for full system compromise, administrators should treat this vulnerability with high urgency. Ensure that the WordPress installation is running with the principle of least privilege to limit the impact of a successful file inclusion attack, and apply vendor updates as soon as they become available.

Description Summary:
The Elated-Themes Frappé theme for WordPress is vulnerable to local file inclusion due to improper control of filenames used in PHP include statements.

Executive Summary:
A high-severity local file inclusion vulnerability in the Elated-Themes Frappé WordPress theme could allow an unauthenticated attacker to access or execute arbitrary files on the server.

Vulnerability Details

CVE-ID: CVE-2025-69083

Affected Software: Elated-Themes Frappé

Affected Versions: 0 through 1.8

Vulnerability: This vulnerability, classified as CWE-98, involves the improper handling of filenames within PHP include or require statements. An unauthenticated attacker can leverage this flaw to perform local file inclusion, potentially leading to unauthorized data disclosure or remote code execution.

Business Impact

The ability to include arbitrary local files poses a significant risk to the integrity and confidentiality of the host environment. Successful exploitation may allow attackers to read sensitive configuration files, capture credentials, or execute malicious code, leading to total system compromise. Given the CVSS score of 8.1, this vulnerability represents a severe threat to business operations and data security.

Remediation Plan

Immediate Action: Since a specific patch version is currently unavailable, administrators should immediately disable the Frappé theme if it is not strictly required for business operations.

Proactive Monitoring: Monitor web server logs for suspicious requests containing path traversal patterns, such as sequences of dots and slashes, targeting PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the high potential for impact necessitates proactive risk mitigation.

Analyst Recommendation

The risk associated with this local file inclusion vulnerability is significant, particularly due to the potential for total system compromise. IT administrators must prioritize the removal or containment of the affected theme until a vendor-supplied security update is released and verified. Continuous monitoring of server access logs is essential to detect any attempts to exploit this flaw while the software remains in an unpatched state.

Description Summary:
A local file inclusion vulnerability in the Elated-Themes Neo Ocular WordPress theme allows unauthenticated attackers to include arbitrary files via improper filename control.

Executive Summary:
The Neo Ocular WordPress theme is vulnerable to a critical local file inclusion flaw that could allow unauthenticated attackers to execute arbitrary code or access sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-67920

Affected Software: Elated-Themes Neo Ocular

Affected Versions: 0 through 1.2

Vulnerability: This vulnerability, categorized as CWE-98, involves the improper control of filenames used in PHP include or require statements. An unauthenticated remote attacker can leverage this flaw to perform local file inclusion, potentially leading to full system compromise.

Business Impact

The exploitation of this vulnerability carries a severe risk to business operations, as it allows for unauthorized access to sensitive server files and potentially remote code execution. With a CVSS score of 9.8, this flaw represents a critical threat to data integrity, confidentiality, and overall system availability, necessitating immediate remediation.

Remediation Plan

Immediate Action: Update the Neo Ocular theme to the latest available version provided by Elated-Themes to patch the underlying PHP inclusion flaw.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal patterns or unexpected file inclusions, particularly those targeting PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious directory traversal attempts and unexpected file inclusion payloads directed at the web server.

Exploitation Status

Public Exploit Available: No (Exploit status is unknown).

Analyst Notes: As of January 8, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the CVSS score is high, the attack complexity is noted as high, which may hinder automated mass-exploitation efforts.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for total system impact, organizations using the Neo Ocular theme must prioritize updating their software immediately. If an update is not currently available, ensure that the theme is disabled or that compensating controls are in place to prevent unauthorized file access until the vendor releases a patch.

Description Summary:
The Elated-Themes Savory theme for WordPress is vulnerable to remote file inclusion via improper control of filenames used in include or require statements.

Executive Summary:
A remote file inclusion vulnerability in the Elated-Themes Savory WordPress theme allows unauthenticated attackers to execute arbitrary code or access sensitive files.

Vulnerability Details

CVE-ID: CVE-2025-62067

Affected Software: Elated-Themes Savory

Affected Versions: 0 through 2.5

Vulnerability: This flaw exists due to improper validation of filenames used in PHP include or require statements, allowing an unauthenticated attacker to include unauthorized files. This vulnerability facilitates remote file inclusion, which can lead to full system compromise.

Business Impact

The ability for an unauthenticated attacker to perform remote file inclusion poses a severe risk to organizational security, as it typically leads to remote code execution. A successful exploit could result in total system compromise, unauthorized data exfiltration, and significant service downtime. Given the CVSS score of 8.1, this represents a high-severity risk that requires immediate prioritization.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately disable or remove the Savory theme if it is not strictly necessary for business operations. If the theme must remain active, contact the vendor for immediate security guidance or updates.

Proactive Monitoring: Review web server access logs for anomalous requests containing suspicious file paths or attempts to access non-existent PHP files. Monitor for unexpected outbound network connections from the web server.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious inclusion attempts or directory traversal patterns commonly associated with file inclusion attacks.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of November 8, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly dangerous, the high complexity rating in the CVSS vector suggests that exploitation may require specific environmental conditions.

Analyst Recommendation

This vulnerability is critical due to the potential for remote code execution via file inclusion. Organizations currently utilizing the Elated-Themes Savory theme should treat this as a high-priority issue. If a vendor update is not available, take the theme offline immediately to prevent potential exploitation until a verified fix is provided.

Description Summary:
The Elated-Themes Search & Go WordPress theme (up to version 2.7) contains an authentication bypass vulnerability in the password recovery mechanism, allowing unauthorized access.

Executive Summary:
An authentication bypass vulnerability in the Search & Go WordPress theme allows attackers to compromise user accounts, requiring an immediate update to the latest available version.

Vulnerability Details

CVE-ID: CVE-2025-62064

Affected Software: Elated-Themes Search & Go

Affected Versions: 0 through 2.7

Vulnerability: This vulnerability involves an authentication bypass via an alternate path or channel within the theme's password recovery process. Per the CVSS vector (PR:N), the vulnerability is exploitable by unauthenticated attackers.

Business Impact

An authentication bypass allows attackers to hijack user accounts, including administrative accounts, potentially leading to unauthorized data access, site defacement, or complete site takeover. The 9.8 CVSS score highlights the extreme risk to the confidentiality, integrity, and availability of the affected WordPress installation.

Remediation Plan

Immediate Action: Update the Search & Go theme to the latest patched version provided by Elated-Themes.

Proactive Monitoring: Monitor user account activity logs for anomalous password reset requests or unauthorized access from unrecognized IP addresses.

Compensating Controls: Disable the theme's password recovery functionality if an update is not immediately feasible, or implement strict rate-limiting on the password reset endpoint via a WAF.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Nov 6, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Authentication bypasses are highly attractive targets for automated exploitation scripts.

Analyst Recommendation

Given the ability for unauthenticated attackers to bypass security controls, this vulnerability is of the highest priority. Administrators should apply the theme update immediately and perform a security audit of user accounts to ensure no unauthorized access has already occurred.

Description Summary:
The Elated-Themes Academist WordPress theme is vulnerable to PHP Remote File Inclusion due to improper control of filenames used in include or require statements.

Executive Summary:
A critical remote file inclusion vulnerability in the Elated-Themes Academist WordPress theme allows unauthenticated attackers to potentially execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-62055

Affected Software: Elated-Themes Academist

Affected Versions: 0 through 1.3

Vulnerability: This vulnerability, identified as CWE-98, occurs when user-supplied input is improperly handled in PHP include or require functions. An unauthenticated attacker can exploit this to include malicious files, leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational infrastructure. An attacker could gain unauthorized access to the web server, modify sensitive data, or compromise the entire underlying application environment, resulting in significant operational downtime and potential data exfiltration. The CVSS score of 8.1 reflects the high severity of this flaw, primarily driven by the potential for full system impact.

Remediation Plan

Immediate Action: Review the official Patchstack vendor advisory for the latest update and apply it immediately to move beyond version 1.3.

Proactive Monitoring: Monitor server access logs for suspicious requests containing file paths or external URLs within query parameters directed at the theme directory.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal or remote file inclusion attempts targeting the WordPress theme.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of November 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed, the nature of remote file inclusion flaws makes them high-value targets for automated scanning and exploitation.

Analyst Recommendation

The risk associated with this vulnerability is high due to the potential for unauthenticated remote code execution. Administrators should prioritize updating the Academist theme to the latest available version. If an update is not yet available from the vendor, consider temporarily deactivating the theme or restricting access to the affected site until a secure version is deployed.

Description Summary:
The Search & Go WordPress theme is vulnerable to unauthenticated account takeover due to improper validation in the Facebook login function, allowing attackers to access any account including admins.

Executive Summary:
A critical authentication bypass vulnerability in the Search & Go WordPress theme allows unauthenticated attackers to hijack user accounts, including administrative accounts.

Vulnerability Details

CVE-ID: CVE-2025-11522

Affected Software: Elated Themes Search & Go - Directory WordPress Theme

Affected Versions: 0 through 2.7

Vulnerability: This vulnerability occurs within the search_and_go_elated_check_facebook_user function, which fails to properly validate user credentials during Facebook authentication. This flaw permits unauthenticated attackers to bypass authentication mechanisms and gain full access to arbitrary user accounts if the Facebook login feature is enabled.

Business Impact

Successful exploitation grants an attacker full control over compromised accounts, including those with administrative privileges. This creates a high risk of unauthorized data access, malicious content injection, and total site compromise. Given the CVSS score of 9.8, this vulnerability poses an extreme risk to the confidentiality, integrity, and availability of the affected WordPress environment.

Remediation Plan

Immediate Action: Identify if the Facebook login feature is currently enabled on your site and disable it immediately until a patch is applied. Check the vendor website for the latest theme update and apply it as soon as it becomes available.

Proactive Monitoring: Review WordPress access logs for suspicious login patterns or unauthorized administrative actions. Monitor for unexpected user account modifications or password resets occurring outside of normal business operations.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests targeting the vulnerable authentication endpoint. Restrict access to the login page by IP address if possible to limit the attack surface.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 9, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited in the wild, the lack of authentication requirements makes this flaw highly dangerous to exposed WordPress installations.

Analyst Recommendation

The severity of this flaw cannot be overstated, as it allows for complete account takeover without any prior authentication. Administrators should prioritize the immediate disabling of the vulnerable Facebook login functionality and monitor vendor channels closely for an official patch release to permanently resolve this security gap.