Executive brief
Wanium, a professional WordPress theme used for website design, contains a security flaw that allows unauthorized users to access sensitive internal files. An attacker could exploit this to view configuration files containing database credentials or other private server information. This could lead to a full takeover of the website and its data. At the time of this report, no official patch has been released by the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Wanium theme for WordPress (versions <= 1.9.8) due to improper validation of user-supplied input in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this by sending specially crafted requests to include local files from the server's filesystem. Successful exploitation can result in the disclosure of sensitive information, such as the wp-config.php file containing database credentials, which may lead to remote code execution or full site compromise. The attack vector is network-based with high complexity and requires no user interaction. As of the advisory date, no official patch is available.
Affected products
- THEMELOGI Wanium <= 1.9.8
Timeline
- 2025-10-28: other: Vulnerability reported by researcher to Patchstack
- 2026-05-26: advisory: Initial advisory published by Patchstack
- 2026-06-17: disclosed: CVE published to NVD