Executive brief
Rosaleen, a WordPress theme used for website design and layout, contains a security flaw that allows unauthorized users to access sensitive internal files. An attacker could exploit this to steal configuration data, such as database credentials, potentially leading to a full takeover of the website and its data. There is currently no official patch available from the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Rosaleen WordPress theme (versions <= 2.8) due to improper validation of user-supplied input used in PHP include or require statements (CWE-98). An unauthenticated remote attacker can exploit this by sending crafted requests to include local files from the server's filesystem. Successful exploitation can result in the disclosure of sensitive information, such as the wp-config.php file containing database credentials, or potentially remote code execution if the attacker can control the contents of an included file. As of the advisory date, no official patch has been released.
Affected products
- ThemeREX Rosaleen <= 2.8
Timeline
- 2025-10-15: other: Vulnerability reported by researcher
- 2026-05-26: advisory: Patchstack published vulnerability details
- 2026-06-17: disclosed: NVD publication date