Executive brief
The Snowy theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access sensitive internal files. By exploiting this vulnerability, an attacker could view configuration files containing database credentials or other private information, potentially leading to a full takeover of the website. This issue affects all versions of the theme up to and including 1.13, and there is currently no official fix available from the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Snowy theme for WordPress through version 1.13. The flaw stems from improper control of filenames used in PHP include or require statements (CWE-98), allowing an unauthenticated remote attacker to specify local files for execution or display. While the attack complexity is rated as high, a successful exploit enables the attacker to read sensitive files such as wp-config.php, which may contain database credentials. As of the advisory date, no official patch has been released by the vendor, though third-party mitigation rules are available.
Affected products
- ThemeREX Snowy <= 1.13
Timeline
- 2025-11-09: other: Vulnerability reported by researcher Bonds
- 2026-05-27: advisory: Patchstack published vulnerability details
- 2026-06-17: disclosed: CVE published to NVD