Executive brief
Neuronet is a WordPress theme used to design and manage the appearance of websites. A security flaw in versions older than 1.14.0 allows an attacker to access sensitive internal files on the web server without needing a password. This could lead to the exposure of database credentials, configuration files, and other private data, potentially resulting in a full site takeover.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Neuronet theme for WordPress in versions prior to 1.14.0. The flaw stems from improper control of filenames used in PHP include or require statements (CWE-98), allowing an unauthenticated attacker to specify local files for execution or display. While the CVSS vector indicates high complexity (AC:H), a successful exploit enables the attacker to retrieve sensitive information such as wp-config.php, which contains database credentials. The vulnerability is resolved in version 1.14.0.
Affected products
- ThemeREX Neuronet < 1.14.0
Timeline
- 2025-09-07: other: Reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity)
- 2025-10-07: disclosed: Vulnerability details published by Patchstack
- 2025-10-07: patched: Version 1.14.0 released to address the issue
- 2026-06-17: advisory: CVE published in NVD