Executive brief
HomeRoofer is a WordPress theme used for building professional roofing and construction websites. A security flaw allows unauthenticated attackers to access sensitive internal files on the web server, such as configuration files containing database credentials. This could lead to a complete takeover of the website and its data.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the HomeRoofer theme for WordPress due to improper control of filenames in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this by sending a specially crafted request to include local files from the server. Successful exploitation can lead to the disclosure of sensitive information, such as wp-config.php, or potentially remote code execution if the attacker can upload or influence the contents of a local file. The vulnerability is patched in version 2.12.0.
Affected products
- ThemeREX HomeRoofer <= 2.11.0
Timeline
- 2025-09-10: other: Reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity)
- 2025-10-10: advisory: Patchstack advisory published
- 2026-06-17: disclosed: CVE published to NVD