Executive brief
The Snow Club theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access sensitive files on the web server. By exploiting this vulnerability, an attacker could view internal configuration files, such as those containing database credentials, potentially leading to a full takeover of the website and its data. This issue affects all versions of the theme up to and including 1.1, and there is currently no official fix available from the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Snow Club theme for WordPress through version 1.1. The flaw stems from improper control of filenames in PHP include/require statements (CWE-98), allowing an unauthenticated remote attacker to include arbitrary files from the local file system. While the CVSS vector indicates high complexity (AC:H), successful exploitation can lead to the disclosure of sensitive information, such as wp-config.php, or potentially remote code execution if the attacker can influence the contents of an included file. As of the advisory date, no official patch has been released, and users are advised to use third-party mitigation tools or switch themes.
Affected products
- ThemeREX Snow Club <= 1.1
Timeline
- 2025-10-15: other: Vulnerability reported by researcher
- 2026-05-26: advisory: Patchstack published advisory
- 2026-06-17: disclosed: CVE published to NVD