Executive brief
The Top Dog theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access sensitive files on the web server. By exploiting this vulnerability, an attacker could view configuration files containing database credentials or other private information, potentially leading to a full takeover of the website. As of the latest report, there is no official patch available from the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Top Dog theme for WordPress through version 1.0.5. The flaw stems from improper control of filenames used in PHP 'include' or 'require' statements (CWE-98), allowing an unauthenticated attacker to supply malicious input that references local files. While the attack complexity is rated as high, a successful exploit enables the attacker to disclose the contents of sensitive files such as wp-config.php, which may contain database credentials. No official patch has been released by the vendor, though third-party mitigation rules are available.
Affected products
- ThemeREX Top Dog <= 1.0.5
Timeline
- 2025-10-31: other: Vulnerability reported by researcher Bonds
- 2026-05-26: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD advisory published