Executive brief
The Shuffle WordPress theme is a popular design template used to build website layouts. Versions 1.8 and earlier contain a vulnerability that allows attackers to read sensitive files directly from web servers without needing to log in. An attacker could exploit this to access database credentials, configuration files, or other private data, potentially leading to full website compromise.
Technical details
The vulnerability is a local file inclusion (LFI) flaw affecting Shuffle theme versions 1.8 and earlier. It requires no authentication and can be exploited over the network by crafting malicious requests to include arbitrary files from the server filesystem. An attacker can read sensitive server files such as wp-config.php (containing database credentials), /etc/passwd, or other configuration files, potentially enabling further compromise. The vulnerability is patched in version 1.9 and later.
Affected products
- Shuffle Shuffle WordPress Theme ≤ 1.8
Timeline
- 2025-06-08: disclosed: Reported to Patchstack
- 2026-08-19: advisory
- 2026-08-19: patched: Version 1.9 released with fix