Description Summary:
The Brook WordPress theme is vulnerable to Local File Inclusion (LFI) due to improper control of filenames used in include/require statements.

Executive Summary:
A Local File Inclusion vulnerability in the ThemeMove Brook WordPress theme allows authenticated attackers to potentially execute arbitrary code or access sensitive server files.

Vulnerability Details

CVE-ID: CVE-2026-57791

Affected Software: ThemeMove Brook

Affected Versions: 0 through 2.9.0

Vulnerability: This is a Local File Inclusion (LFI) vulnerability (CWE-98) where an authenticated user with low privileges can manipulate file paths in include/require statements. The vulnerability requires high attack complexity but allows for significant impact on system integrity and confidentiality.

Business Impact

Successful exploitation of this flaw can lead to unauthorized access to sensitive configuration files or the execution of arbitrary PHP code on the server. Given the CVSS score of 7.5, this vulnerability is categorized as High severity, posing a significant risk to the confidentiality and integrity of the affected WordPress environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should immediately disable or remove the affected theme if it is not business-critical.

Proactive Monitoring: Review web server access logs for suspicious requests containing path traversal sequences or unexpected file inclusions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common LFI patterns and path traversal attempts targeting the WordPress theme directory.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for remote code execution, necessitating strict access controls until a patch is released.

Analyst Recommendation

Due to the lack of an available security patch, users of the Brook theme must prioritize risk mitigation through temporary deactivation or the implementation of strict WAF filtering. Organizations should monitor vendor communications closely for the release of a patched version and apply it immediately upon availability.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the Billey WordPress theme allows authenticated users with low privileges to include arbitrary local files.

Executive Summary:
The Billey WordPress theme is vulnerable to Local File Inclusion, which could allow an authenticated attacker to access sensitive server files.

Vulnerability Details

CVE-ID: CVE-2026-57790

Affected Software: ThemeMove Billey

Affected Versions: 0 through 2.1.8

Vulnerability: This vulnerability is a PHP Local File Inclusion (CWE-98) flaw occurring due to improper validation of filenames in include/require statements. It requires the attacker to have at least low-level authenticated access to the WordPress instance.

Business Impact

With a CVSS score of 7.5 (High), this vulnerability poses a severe risk to the confidentiality and integrity of the affected website. Successful exploitation could allow an attacker to bypass security restrictions to read sensitive server-side files, potentially leading to further compromise of the web server.

Remediation Plan

Immediate Action: No patch is currently available; administrators should deactivate the Billey theme until a secure update is released by the vendor.

Proactive Monitoring: Monitor site traffic and server logs for signs of path traversal attempts, particularly those targeting core system or configuration files.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block incoming requests containing malicious path traversal strings.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable if the theme is left in an unpatched state on an accessible WordPress site.

Analyst Recommendation

Due to the high-risk nature of this LFI vulnerability, administrators must act quickly. In the absence of a vendor patch, deactivating the Billey theme is the only effective way to prevent potential exploitation until the developer releases a secure version.

Description Summary:
The ThemeMove Unicamp theme for WordPress contains a Local File Inclusion (LFI) vulnerability due to improper control of filenames in PHP include statements.

Executive Summary:
ThemeMove Unicamp is vulnerable to Local File Inclusion (LFI), allowing an attacker to read sensitive files or potentially execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2026-25027

Affected Software: ThemeMove Unicamp

Affected Versions: See vendor advisory for affected versions

Vulnerability: This is a Local File Inclusion (LFI) vulnerability caused by improper control of filenames in PHP include or require statements. An attacker can manipulate input parameters to force the application to include local files, potentially leading to the disclosure of sensitive configuration files like wp-config.php.

Business Impact

Successful exploitation allows an attacker to access sensitive server-side files, which can contain database credentials or system configurations. With a CVSS score of 7.5, this vulnerability could escalate to full remote code execution (RCE) if the attacker can upload or find a way to execute a malicious file, resulting in a total system compromise.

Remediation Plan

Immediate Action: Update the ThemeMove Unicamp theme to the latest version immediately to patch the insecure PHP inclusion logic.

Proactive Monitoring: Scan web server logs for directory traversal patterns (e.g., ../../etc/passwd) in URL parameters.

Compensating Controls: Disable allow_url_include in the PHP configuration and use a WAF to filter out common LFI attack strings.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 5, 2026, there is no public information indicating active exploitation of this vulnerability. LFI vulnerabilities in WordPress themes are frequently targeted by automated exploit kits.

Analyst Recommendation

The severity of LFI vulnerabilities cannot be overstated, as they often serve as the first step in a multi-stage attack. You must apply the theme update immediately to prevent unauthorized file access and potential server takeover.

Description Summary:
The MinimogWP WordPress theme is vulnerable to price manipulation via insufficient quantity validation, allowing unauthenticated attackers to alter checkout prices by injecting fractional quantities.

Executive Summary:
The MinimogWP WordPress theme is affected by a critical price manipulation vulnerability that allows unauthenticated attackers to modify cart totals, posing a significant risk to e-commerce integrity.

Vulnerability Details

CVE-ID: CVE-2025-8198

Affected Software: ThemeMove MinimogWP

Affected Versions: 0 through 3.9.0

Vulnerability: This vulnerability is caused by an insufficient check on quantity values within the cart functionality. An unauthenticated attacker can exploit this flaw to set item quantities to fractional values, effectively bypassing price calculations and manipulating the total cost of an order.

Business Impact

Successful exploitation of this flaw can lead to direct financial loss by allowing customers to purchase goods at unauthorized prices. Given the CVSS score of 7.5, this high-severity issue compromises the integrity of the transaction process, potentially resulting in significant revenue loss and damage to business operations.

Remediation Plan

Immediate Action: Update the MinimogWP theme to the latest version provided by ThemeMove, or ensure that the WooCommerce plugin is updated to version 9.8.2 or higher, which prevents the exploitation of this flaw.

Proactive Monitoring: Review WooCommerce order logs for unusual transaction values, specifically looking for orders containing fractional quantities or unexpected price discrepancies.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block anomalous input parameters in shopping cart requests, particularly those attempting to submit non-integer values for item quantities.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 28, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the vulnerability is easily automatable, the risk is mitigated by updating the underlying WooCommerce plugin, which serves as a robust defense against this specific vector.

Analyst Recommendation

Organizations utilizing the MinimogWP theme must prioritize applying the recommended updates to either the theme or the WooCommerce plugin immediately. Failure to remediate this vulnerability leaves the checkout process exposed to direct financial manipulation, and administrators should verify that the installed WooCommerce version is at least 9.8.2 to ensure the flaw is effectively neutralized.

Description Summary:
A SQL injection vulnerability in the Unicamp theme allows authenticated subscribers to execute arbitrary database queries, potentially leading to data theft or unauthorized access.

Executive Summary:
An authenticated SQL injection vulnerability in the Unicamp theme poses a critical threat to database confidentiality and integrity for affected WordPress sites.

Vulnerability Details

CVE-ID: CVE-2025-69094

Affected Software: ThemeMove Unicamp

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The theme fails to properly sanitize input in specific parameters, allowing a user with subscriber-level access to inject malicious SQL commands into the backend database.

Business Impact

Successful exploitation allows an attacker to bypass access controls, extract sensitive user information, or modify site data. With a CVSS score of 8.5, this vulnerability represents a severe risk to data privacy and could lead to significant reputational and operational damage if databases are compromised.

Remediation Plan

Immediate Action: Update the Unicamp theme to the latest version, ensuring all security patches are applied.

Proactive Monitoring: Review database query logs for suspicious patterns or anomalous syntax indicative of SQL injection attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter incoming requests for SQL injection patterns and restrict user registration if it is not required for business operations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations using the Unicamp theme must ensure that they are running the latest version to close this security gap. Given that this vulnerability can be exploited by authenticated subscribers, minimizing user privileges and monitoring for unauthorized database access are essential steps to mitigate risk.

Description Summary:
The MinimogWP theme for WordPress is susceptible to a Local File Inclusion vulnerability due to improper control of filenames used in PHP include or require statements.

Executive Summary:
The ThemeMove MinimogWP theme contains a high-severity local file inclusion vulnerability that could allow an authenticated attacker to compromise site integrity and availability.

Vulnerability Details

CVE-ID: CVE-2025-68062

Affected Software: ThemeMove MinimogWP

Affected Versions: 0 through 3.9.6

Vulnerability: This vulnerability involves the improper handling of filenames within PHP include or require functions. An attacker with low-level privileges (authenticated) can leverage this flaw to perform Local File Inclusion, potentially accessing or executing unauthorized files on the server.

Business Impact

Successful exploitation of this vulnerability allows an attacker to read sensitive files or potentially execute arbitrary code, leading to a full system compromise. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to data confidentiality and application integrity, potentially resulting in unauthorized access to sensitive site configurations or user data.

Remediation Plan

Immediate Action: There is no known patch available at this time; users should monitor the vendor website for updates or consider switching to an alternative theme until a fix is released.

Proactive Monitoring: Review web server access logs for suspicious file inclusion patterns, such as requests containing directory traversal sequences or unexpected file extensions in parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious file inclusion requests targeting the WordPress installation.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available for this vulnerability.

Analyst Notes: As of December 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for authenticated access limits the attack surface, but the potential for total impact remains a significant concern.

Analyst Recommendation

Given the high impact of this local file inclusion vulnerability, organizations should prioritize limiting access to the affected application and monitoring for any unauthorized activity. Since an official patch is currently unavailable, implementing strict access controls and WAF filtering is essential to mitigate the risk until the vendor provides a remediation update.

Description Summary:
The EduMall theme for WordPress contains a Local File Inclusion vulnerability due to improper filename control in include or require statements.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the ThemeMove EduMall WordPress theme could allow an authenticated attacker to compromise site integrity and execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2025-68061

Affected Software: ThemeMove EduMall

Affected Versions: 0 through 4.4.7

Vulnerability: This vulnerability, classified as CWE-98, involves improper control of filenames in PHP include statements. An authenticated user with low privileges can exploit this flaw to perform Local File Inclusion, potentially accessing sensitive files or executing arbitrary PHP code on the server.

Business Impact

Successful exploitation of this flaw can lead to a complete compromise of the WordPress environment, as it allows attackers to read sensitive configuration files or execute malicious scripts. Given the CVSS score of 7.5, this represents a significant risk to data confidentiality, system integrity, and availability. Organizations relying on this theme for e-commerce or educational delivery face potential service disruption and exposure of proprietary data.

Remediation Plan

Immediate Action: Review the official Patchstack advisory for the latest security update and apply it immediately to move beyond version 4.4.7. If a patch is not yet available for your specific deployment, consider temporarily disabling the theme or restricting access to the affected site functions.

Proactive Monitoring: Monitor server access logs for unusual file path patterns, such as directory traversal sequences (e.g., ../../) or attempts to include non-PHP files within the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion patterns and directory traversal attempts to mitigate the risk while awaiting a formal vendor patch.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of December 17, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While currently unexploited in the wild, the technical nature of the flaw makes it a high-value target for attackers looking to gain unauthorized code execution.

Analyst Recommendation

The vulnerability presents a serious risk to any WordPress instance utilizing the EduMall theme. Security teams should prioritize identifying all instances of this theme within their environment and verifying the version numbers. Given the potential for remote code execution, it is imperative to apply updates as soon as the vendor releases a fix to ensure the security of the underlying application infrastructure.

Description Summary:
ThemeMove EduMall is vulnerable to Local File Inclusion, allowing unauthenticated attackers to manipulate file paths and potentially access sensitive server files or execute unauthorized code.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the ThemeMove EduMall WordPress theme poses a critical risk of unauthorized file access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2025-59564

Affected Software: ThemeMove EduMall

Affected Versions: 0 through 4.4.5

Vulnerability: This vulnerability, classified as CWE-98, arises from improper control of filenames used in PHP include or require statements. An unauthenticated attacker can exploit this flaw to perform Local File Inclusion, which may lead to the disclosure of sensitive information or remote code execution.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting a high risk to confidentiality, integrity, and availability. Successful exploitation could allow an attacker to read configuration files, access sensitive data, or gain control over the web server, leading to significant reputational damage and potential loss of intellectual property.

Remediation Plan

Immediate Action: Update the EduMall theme to version 4.4.5 or the latest available version provided by the vendor to remediate the vulnerability.

Proactive Monitoring: Review web server access logs for suspicious requests containing directory traversal patterns or unexpected file path inclusions, particularly targeting PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious path traversal attempts and common Local File Inclusion attack vectors.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While the lack of a public exploit reduces immediate urgency, the nature of the flaw makes it a primary target for automated scanning and exploitation.

Analyst Recommendation

Given the high severity of this Local File Inclusion vulnerability, organizations using the EduMall theme must prioritize an immediate update to the latest patched version. If an update is not immediately feasible, ensure that rigorous WAF protections are in place to prevent unauthenticated access to sensitive system files.

Description Summary:
A local file inclusion vulnerability in the ThemeMove Billey WordPress theme allows attackers to include arbitrary files, potentially leading to unauthorized data access or code execution.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeMove Billey theme exposes systems to potential unauthorized file access and remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-59558

Affected Software: ThemeMove Billey

Affected Versions: 0 through 2.1.6

Vulnerability: This vulnerability is classified as an Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98). It allows an unauthenticated attacker to perform local file inclusion by manipulating input parameters passed to the theme.

Business Impact

The vulnerability carries a CVSS score of 8.1, indicating a high level of risk to confidentiality, integrity, and availability. Successful exploitation could allow an attacker to read sensitive configuration files or execute arbitrary code, potentially leading to a complete compromise of the WordPress environment and significant data breach.

Remediation Plan

Immediate Action: Update the ThemeMove Billey theme to version 2.1.6 or higher to resolve the insecure file inclusion path.

Proactive Monitoring: Inspect web server access logs for anomalous requests containing directory traversal patterns or unexpected file path references.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing suspicious path traversal characters or attempts to access restricted system files.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is inherently dangerous due to the potential for file inclusion, the high attack complexity noted in the CVSS vector suggests that specific environmental conditions may be required for a successful exploit.

Analyst Recommendation

Given the high impact of this vulnerability, administrators should prioritize updating the affected theme immediately. If an update is not immediately feasible, ensure that rigorous input validation is enforced and that the application is protected by a WAF to mitigate the risk of unauthorized file access.

Description Summary:
A SQL injection vulnerability in the ThemeMove Learts Addons plugin for WordPress allows unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
The Learts Addons plugin for WordPress is vulnerable to unauthenticated SQL injection, posing a critical risk of database information disclosure.

Vulnerability Details

CVE-ID: CVE-2025-59557

Affected Software: ThemeMove Learts Addons

Affected Versions: 0 through 1.7.4

Vulnerability: This is a SQL injection vulnerability (CWE-89) where the plugin fails to properly sanitize user-supplied input. The CVSS vector (AV:N/AC:L/PR:N) confirms that an unauthenticated attacker can execute this exploit remotely without requiring prior access or interaction.

Business Impact

Successful exploitation allows an attacker to interact directly with the underlying database, potentially leading to the unauthorized exfiltration of sensitive configuration data or user information. While the CVSS score of 9.3 highlights a critical severity, the impact is primarily focused on data confidentiality and limited system availability, which could disrupt business operations and compromise customer trust.

Remediation Plan

Immediate Action: Update the Learts Addons plugin to version 1.7.5 or later immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Monitor database query logs for unusual patterns, such as unexpected UNION SELECT statements or syntax errors that deviate from standard application behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting WordPress plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Oct 22, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication.

Analyst Recommendation

Given the ease of exploitation and the potential for unauthorized data access, all administrators using the Learts Addons plugin must prioritize updating to version 1.7.5. Failure to apply this patch leaves the application exposed to remote attackers capable of extracting sensitive database contents.

Description Summary:
The ThemeMove Medizin WordPress theme contains a local file inclusion vulnerability, allowing unauthenticated attackers to include arbitrary files on the server.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeMove Medizin theme allows unauthenticated attackers to potentially read sensitive files or execute code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-59555

Affected Software: ThemeMove Medizin

Affected Versions: 0 through 1.9.7

Vulnerability: This flaw is an improper control of filename for include or require statements, commonly known as local file inclusion. The vulnerability is accessible to unauthenticated attackers, who can manipulate input parameters to include unauthorized files within the PHP environment.

Business Impact

The vulnerability carries a CVSS score of 8.1, reflecting its high potential for impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to read sensitive configuration files, access database credentials, or achieve remote code execution, leading to full site compromise and significant data exfiltration risks.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, users should immediately deactivate the Medizin theme if it is not business-critical or switch to an alternative theme until the vendor releases a secure update.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious path traversal patterns, such as sequences like ../ or unexpected file extensions being passed to theme-related parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and unauthorized file inclusion requests targeting the WordPress theme directory.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known patch is concerning, the high severity of local file inclusion requires immediate defensive posture and strict perimeter controls.

Analyst Recommendation

Given the severity of this vulnerability, organizations using the Medizin theme must prioritize risk mitigation immediately. If the vendor has not provided a patch, the most effective defense is to remove or disable the vulnerable component. Administrators should remain vigilant for vendor security advisories and apply updates as soon as they become available to ensure the integrity of the WordPress environment.

Description Summary:
The ThemeMove Businext WordPress theme is vulnerable to local file inclusion due to improper control of filenames used in PHP include statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeMove Businext theme allows unauthenticated attackers to potentially read sensitive files or execute arbitrary code on the server.

Vulnerability Details

CVE-ID: CVE-2025-58967

Affected Software: ThemeMove Businext

Affected Versions: 0 through 2.4.4

Vulnerability: This vulnerability, classified as CWE-98, occurs when the application fails to properly sanitize user-supplied input used in file include operations. An unauthenticated attacker can leverage this flaw to include local files, leading to unauthorized information disclosure or potential remote code execution.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to organizational security. An attacker could gain access to configuration files, credentials, or other sensitive data stored on the web server, potentially leading to a full system compromise. With a CVSS score of 8.2, this vulnerability represents a high risk that could lead to significant reputational damage and operational disruption if left unaddressed.

Remediation Plan

Immediate Action: Review the official Patchstack advisory to determine if a vendor-supplied update is available, and immediately update the Businext theme to version 2.4.4 or higher. If no update is available, consider switching to an alternative theme until a secure version is released.

Proactive Monitoring: Monitor web server logs for suspicious requests containing directory traversal patterns or unexpected file paths, particularly those targeting include functions.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block malicious requests that attempt to exploit file inclusion vulnerabilities by filtering inputs containing directory traversal characters.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the lack of a known exploit reduces immediate urgency, the nature of local file inclusion flaws makes them highly dangerous if discovered by malicious actors.

Analyst Recommendation

Given the potential for high-impact compromise, administrators must prioritize the remediation of this vulnerability. If an official patch is not currently available from the vendor, immediate action should be taken to mitigate the risk through the application of compensating security controls or the temporary suspension of the affected theme. Organizations should remain vigilant for vendor updates and apply them immediately upon release to ensure long-term system integrity.

Description Summary:
A Local File Inclusion (LFI) vulnerability in the ThemeMove SmilePure WordPress theme allows unauthenticated attackers to manipulate file paths to include arbitrary local files.

Executive Summary:
A high-severity Local File Inclusion vulnerability in the ThemeMove SmilePure theme exposes systems to unauthorized file access and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-58958

Affected Software: ThemeMove SmilePure

Affected Versions: 0 through 1.8.5

Vulnerability: The theme suffers from improper control of filenames used in PHP include statements (CWE-98), which allows an unauthenticated attacker to perform Local File Inclusion. By manipulating input parameters, an attacker can force the application to execute or display sensitive files from the server filesystem.

Business Impact

Successful exploitation of this vulnerability can lead to full server compromise, as attackers may gain the ability to read sensitive configuration files or execute arbitrary code. Given the CVSS score of 8.2, this represents a significant risk to data confidentiality, integrity, and system availability. Unauthorized access to the underlying server environment may also lead to further lateral movement within the network.

Remediation Plan

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should immediately deactivate or remove the SmilePure theme if it is not business-critical. If the theme must remain in use, monitor vendor channels for the release of version 1.8.5 or higher and apply it immediately upon availability.

Proactive Monitoring: Review web server and PHP error logs for unusual file inclusion patterns or attempts to access system files such as wp-config.php or /etc/passwd.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block directory traversal and local file inclusion attempts targeting PHP include parameters.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of October 23, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is theoretically dangerous due to the potential for code execution, the high complexity requirement noted in the CVSS vector suggests that exploitation may require specific server configurations or conditions.

Analyst Recommendation

This vulnerability presents a high risk to WordPress environments using the SmilePure theme. Security teams should prioritize identifying all instances of this theme across their infrastructure and treat it as a critical exposure until a vendor-supplied update is verified and installed. Deactivation remains the most effective mitigation until the vendor confirms a secure version is available.

Description Summary:
A local file inclusion vulnerability in ThemeMove MaxCoach allows unauthenticated attackers to include arbitrary files, potentially leading to unauthorized data access or code execution.

Executive Summary:
The ThemeMove MaxCoach theme is susceptible to a local file inclusion vulnerability that could allow unauthenticated attackers to compromise the integrity and availability of the host system.

Vulnerability Details

CVE-ID: CVE-2025-58206

Affected Software: ThemeMove MaxCoach

Affected Versions: 0 through 3.2.5

Vulnerability: The vulnerability is caused by improper control of filenames for include or require statements in PHP, allowing an unauthenticated attacker to perform local file inclusion. This flaw permits the inclusion of unauthorized files, which can be leveraged to read sensitive server data or execute malicious code.

Business Impact

Successful exploitation of this vulnerability poses a significant risk to organizational security, as it allows unauthorized access to sensitive application files and potentially enables remote code execution. With a CVSS score of 8.1, the vulnerability is classified as High severity, reflecting its potential to cause total compromise of the affected system's confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Review the vendor advisory for the release of a security update and apply it immediately to versions 3.2.5 or lower. If a patch is unavailable, consider temporarily switching to a secure theme or restricting access to the affected directory.

Proactive Monitoring: Monitor server access logs for suspicious patterns, such as directory traversal attempts or unexpected file inclusion requests targeting system configuration files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious path traversal strings and unauthorized include requests directed at the WordPress theme directory.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of September 5, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is technically significant, the reliance on specific server configurations often dictates whether a file inclusion flaw can be successfully weaponized.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention to prevent potential system compromise. Administrators should verify the current version of the MaxCoach theme and prioritize the application of any security updates provided by the vendor. In the absence of an official patch, implementing strict file permission controls and WAF filtering is essential to mitigate the risk of unauthorized file access.

Description Summary:
The ThemeMove Unicamp WordPress theme is vulnerable to local file inclusion due to improper control of filenames in PHP include statements, potentially allowing unauthorized file access.

Executive Summary:
A high-severity local file inclusion vulnerability in the ThemeMove Unicamp theme allows unauthenticated attackers to potentially read sensitive files or achieve code execution.

Vulnerability Details

CVE-ID: CVE-2025-54701

Affected Software: ThemeMove Unicamp

Affected Versions: 0 through 2.6.3

Vulnerability: This vulnerability is a local file inclusion flaw (CWE-98) occurring within the theme's PHP include/require logic. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector AV:N/PR:N/UI:N.

Business Impact

Successful exploitation of this vulnerability allows an attacker to include arbitrary local files on the server, which can lead to the exposure of sensitive configuration files or the execution of malicious code. Given the CVSS score of 8.1, the potential for total impact on confidentiality, integrity, and availability poses a significant risk to the security of the hosting environment and the integrity of the application data.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate the Unicamp theme or switch to a secure alternative until a vendor update is released.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal sequences or attempts to include unusual PHP files from the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal patterns and unauthorized file inclusion attempts targeting the theme path.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Analyst Notes: As of August 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires specific conditions to trigger, the ability for an unauthenticated attacker to manipulate file inclusion paths represents a critical security oversight that should be addressed with urgency.

Analyst Recommendation

Given the high CVSS score and the nature of local file inclusion vulnerabilities, the risk of unauthorized system access is significant. It is imperative that organizations running the Unicamp theme prioritize the immediate removal or containment of the affected software until the vendor provides a verified security patch.

Description Summary:
A Local File Inclusion vulnerability in the ThemeMove Makeaholic theme allows unauthenticated attackers to include arbitrary files, potentially leading to remote code execution.

Executive Summary:
The ThemeMove Makeaholic theme is vulnerable to Local File Inclusion, which poses a high risk of unauthorized file access and potential code execution by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2025-54700

Affected Software: ThemeMove Makeaholic

Affected Versions: 0 through 1.8.4

Vulnerability: The theme contains an improper control of filenames for include statements, allowing an unauthenticated attacker to perform Local File Inclusion. This flaw enables the inclusion and execution of arbitrary files on the server.

Business Impact

Successful exploitation allows an attacker to read sensitive files or execute arbitrary PHP code on the underlying server. Given the CVSS score of 8.1, this vulnerability presents a critical threat to data confidentiality, system integrity, and service availability, potentially leading to a complete compromise of the affected WordPress site.

Remediation Plan

Immediate Action: Since no official patch is currently confirmed, administrators should immediately deactivate or uninstall the Makeaholic theme until the vendor releases a secure version.

Proactive Monitoring: Security teams should audit web server access logs for suspicious patterns, such as directory traversal characters or unexpected file path inclusions, originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common Local File Inclusion payloads and directory traversal attempts directed at the WordPress environment.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 15, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication, allowing any remote user to potentially interact with the vulnerable file-handling logic.

Analyst Recommendation

The severity of this Local File Inclusion vulnerability necessitates immediate defensive action. Organizations currently utilizing the Makeaholic theme must prioritize its removal or deactivation, as unauthenticated attackers can leverage this flaw to gain full control over the application server. Monitor vendor channels closely for the release of a security patch.

Description Summary:
A deserialization of untrusted data vulnerability in the ThemeMove Core plugin allows for object injection, potentially leading to unauthorized code execution.

Executive Summary:
A high-severity object injection vulnerability in the ThemeMove Core plugin for WordPress permits authenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-53303

Affected Software: ThemeMove ThemeMove Core

Affected Versions: 0 through 1.4.2

Vulnerability: This flaw is caused by improper deserialization of untrusted data (CWE-502). An authenticated attacker can trigger this vulnerability via the thememove-core component, which fails to validate user-supplied objects before deserializing them.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its potential for total compromise of the affected WordPress instance. Successful exploitation allows an attacker to execute arbitrary code with the privileges of the web server, leading to full site takeover, data exfiltration, or complete system downtime.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, administrators should immediately deactivate and remove the ThemeMove Core plugin until a secure update is released by the vendor.

Proactive Monitoring: Monitor server access logs for unusual POST requests directed at the WordPress plugin directory or specific plugin endpoints that may indicate attempts to inject serialized objects.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block serialized PHP objects in HTTP request parameters to mitigate potential exploitation attempts.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 10, 2025, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. While exploitation requires authenticated access, the impact is severe, and the lack of a defined patch makes immediate deactivation the safest course of action.

Analyst Recommendation

Given the high CVSS score and the nature of object injection, this vulnerability poses a significant risk to the integrity and availability of the host environment. Administrators must prioritize the removal of the vulnerable plugin until the vendor provides a verified security update to address the deserialization flaw.

Description Summary:
The ThemeMove Mitech WordPress theme contains a local file inclusion vulnerability, allowing unauthorized access to files on the server through improper handling of include statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeMove Mitech theme allows unauthenticated attackers to potentially read sensitive files or execute code on the host server.

Vulnerability Details

CVE-ID: CVE-2025-22708

Affected Software: ThemeMove Mitech

Affected Versions: 0 through 2.3.4

Vulnerability: This vulnerability is a local file inclusion flaw caused by improper control of filenames in PHP include or require statements. It allows an unauthenticated attacker to manipulate file paths to access or execute arbitrary files on the system.

Business Impact

The ability to perform local file inclusion presents a severe risk to business operations, as it can lead to the exposure of sensitive configuration files, database credentials, or source code. With a CVSS score of 9.8, this vulnerability carries the potential for full system compromise, which could result in significant data breaches, unauthorized administrative access, and prolonged service downtime.

Remediation Plan

Immediate Action: Users should immediately disable or remove the Mitech theme if a security update is not yet available from the vendor. Check the official Patchstack database and the ThemeMove support portal for the release of a patched version.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous requests containing directory traversal sequences, such as double dots or unexpected file extensions, which are indicative of exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common file inclusion attack patterns and restrict web server file permissions to the absolute minimum required for functionality.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of January 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited in the wild, the technical nature of this flaw makes it highly desirable for attackers seeking to gain persistence on web servers.

Analyst Recommendation

Given the high CVSS severity and the nature of local file inclusion flaws, immediate action is required to secure the environment. Organizations currently utilizing the Mitech theme must prioritize identifying the version in use and applying the vendor-supplied patch as soon as it becomes available to prevent potential remote code execution or data theft.

Description Summary:
The ThemeMove Moody theme for WordPress is vulnerable to local file inclusion due to improper control of filenames in include or require statements.

Executive Summary:
A critical local file inclusion vulnerability in the ThemeMove Moody theme allows unauthenticated attackers to potentially read or execute arbitrary files on the host server.

Vulnerability Details

CVE-ID: CVE-2025-22707

Affected Software: ThemeMove Moody

Affected Versions: 0 through 2.7.3

Vulnerability: The vulnerability, categorized as CWE-98, arises from improper handling of filenames within include or require statements. This flaw enables an unauthenticated attacker to perform local file inclusion, which may lead to unauthorized data access or remote code execution depending on the server environment.

Business Impact

The potential for local file inclusion poses a severe risk to organizational security, as it can lead to the exposure of sensitive configuration files or the execution of malicious code. Given the CVSS score of 9.8, this vulnerability is classified as critical, necessitating immediate attention to prevent full system compromise and potential data breaches.

Remediation Plan

Immediate Action: Users should immediately check for and apply any available security updates from ThemeMove for the Moody theme. If no patch is currently available, administrators should consider deactivating or removing the theme until a secure version is released.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious patterns, such as directory traversal characters or attempts to include non-existent or sensitive PHP files.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attacks and unauthorized file inclusion attempts targeting WordPress themes.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Analyst Notes: As of Jan 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability is highly severe due to its potential for remote code execution, it requires careful configuration to weaponize effectively.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for complete server compromise, organizations utilizing the ThemeMove Moody theme must prioritize remediation. Verify your current version immediately and apply updates as soon as the vendor makes them available to neutralize this high-risk entry point.

Description Summary:
A local file inclusion vulnerability in the ThemeMove Brook WordPress theme allows unauthenticated attackers to include arbitrary local files via improper control of filename parameters.

Executive Summary:
The ThemeMove Brook WordPress theme contains a critical local file inclusion vulnerability that permits unauthenticated attackers to access or execute arbitrary files on the server.

Vulnerability Details

CVE-ID: CVE-2025-14430

Affected Software: ThemeMove Brook - Agency Business Creative

Affected Versions: 0 through 2.9.0

Vulnerability: This vulnerability is identified as a local file inclusion flaw (CWE-98) where the theme fails to properly sanitize input before passing it to include or require statements. An unauthenticated attacker can leverage this to read sensitive files or potentially execute malicious code on the host server.

Business Impact

The ability for an unauthenticated user to perform local file inclusion poses a severe risk to the confidentiality, integrity, and availability of the affected system. With a CVSS score of 9.8, this flaw could lead to full system compromise, including the exposure of database credentials, configuration files, and the execution of unauthorized commands.

Remediation Plan

Immediate Action: Review the ThemeMove official support channels for the release of a security patch and update the Brook theme to the latest version immediately upon availability.

Proactive Monitoring: Monitor server access logs for suspicious requests containing path traversal patterns such as "../" or attempts to include non-PHP files through the theme directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal attempts and suspicious file inclusion requests targeting the WordPress themes directory.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the CVSS score is 9.8, indicating extreme severity, the actual exploitability depends on the specific implementation of the theme's file inclusion logic.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for full remote code execution, administrators should prioritize this issue. If a patch is not yet available, consider temporarily disabling the Brook theme or restricting access to the affected site components until a secure version is deployed.

Description Summary:
A Local File Inclusion vulnerability in the ThemeMove AeroLand WordPress theme allows unauthenticated attackers to include arbitrary files via improper filename control.

Executive Summary:
The ThemeMove AeroLand WordPress theme is vulnerable to a Local File Inclusion flaw that could allow an unauthenticated attacker to execute arbitrary code or access sensitive files.

Vulnerability Details

CVE-ID: CVE-2025-14429

Affected Software: ThemeMove AeroLand

Affected Versions: 0 through 1.6.6

Vulnerability: This is a PHP Local File Inclusion vulnerability (CWE-98) occurring due to improper validation of filenames used in include or require statements. The vulnerability is exploitable by an unauthenticated attacker via a network-based vector.

Business Impact

The ability for an unauthenticated user to perform Local File Inclusion represents a critical security risk. A successful exploit can lead to unauthorized access to sensitive configuration files, potential remote code execution, and full compromise of the affected WordPress site. Given the CVSS score of 9.8, this flaw presents a severe threat to data confidentiality, integrity, and system availability.

Remediation Plan

Immediate Action: Since a specific patch version is not currently identified in the enrichment data, users should immediately audit their use of the AeroLand theme and check the official ThemeMove portal for updates. If no update is available, consider switching to an alternative, well-maintained theme until a fix is released.

Proactive Monitoring: Security teams should review web server access logs for suspicious patterns, such as directory traversal sequences (e.g., ../) or requests targeting sensitive system files like wp-config.php.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block directory traversal attempts and common Local File Inclusion attack signatures.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Jan 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While currently unexploited, the nature of the flaw makes it highly dangerous if a weaponized exploit is released.

Analyst Recommendation

Organizations utilizing the AeroLand theme must treat this vulnerability with extreme urgency. Given the potential for total system compromise, administrators should prioritize the identification and removal of vulnerable instances. If immediate patching is not possible, implementing strict WAF filtering and limiting file system permissions for the web server user are essential steps to mitigate the risk of exploitation.