Executive brief
The Eros theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access sensitive files on the web server. By exploiting this vulnerability, an attacker could view internal configuration files, such as those containing database credentials, potentially leading to a full takeover of the website and its data. This issue affects all versions of the theme up to and including 1.3, and there is currently no official fix from the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Eros theme for WordPress through version 1.3. The flaw stems from improper validation of user-supplied input used in PHP 'include' or 'require' statements (CWE-98), allowing an unauthenticated remote attacker to specify local files for execution or display. While the attack complexity is rated as high, a successful exploit could allow an attacker to retrieve sensitive information such as wp-config.php or other system files, potentially leading to remote code execution if combined with other techniques. As of the advisory date, no official patch has been released by the vendor.
Affected products
- ThemeREX Eros <= 1.3
Timeline
- 2025-11-09: other: Vulnerability reported by researcher Bonds
- 2026-05-27: advisory: Patchstack published vulnerability details
- 2026-06-17: disclosed: CVE published to NVD