Executive brief
The Right Way theme for WordPress is vulnerable to a security flaw that allows unauthorized users to access sensitive files on the web server. This could lead to the exposure of database credentials or other configuration files, potentially resulting in a full takeover of the website. There is currently no official patch available from the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the Themeum Right Way theme for WordPress through version 4.0. The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where the application fails to properly validate user-supplied input used in file inclusion functions. An unauthenticated remote attacker can exploit this by sending crafted requests to include and execute local files on the server. This can lead to the disclosure of sensitive information, such as wp-config.php, or potentially remote code execution if the attacker can upload or influence the contents of local files. As of the advisory date, no official patch has been released.
Affected products
- Themeum Right Way <= 4.0
Timeline
- 2025-09-18: other: Vulnerability reported by researcher
- 2026-01-12: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD publication date