Executive brief
Grecko, a professional theme for WordPress websites, contains a security flaw that allows unauthorized individuals to access sensitive internal files. By exploiting this vulnerability, an attacker could view configuration files containing database credentials, potentially leading to a full takeover of the website and its data. At the time of this report, no official software update has been released to fix the issue.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Grecko theme for WordPress (versions <= 5.17) due to improper control of filenames in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this flaw to include and execute local files on the server. While the attack complexity is rated as high, successful exploitation could allow the attacker to read sensitive files like wp-config.php, leading to credential theft and potential remote code execution. As of the advisory date, no official patch is available, and users are advised to use third-party mitigation rules or switch themes.
Affected products
- ThemeREX Grecko <= 5.17
Timeline
- 2025-11-09: other: Vulnerability reported by researcher Bonds
- 2026-05-27: advisory: Patchstack published vulnerability details
- 2026-06-17: disclosed: CVE published to NVD