Executive brief
The AutoParts theme for WordPress, used for e-commerce and automotive websites, contains a security flaw that allows unauthorized users to access sensitive files on the server. An attacker could use this to steal database credentials or other configuration files, potentially leading to a full takeover of the website and its data. As of the latest report, there is no official patch available from the developer.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX AutoParts theme for WordPress (versions <= 1.5.8) due to improper control of filenames in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this by sending specially crafted requests to include local files from the server's filesystem. Successful exploitation can lead to the disclosure of sensitive information, such as the wp-config.php file containing database credentials, or potentially remote code execution if the attacker can upload or find a controllable file on the system. No official patch has been released; users are advised to use web application firewalls or third-party mitigation services.
Affected products
- ThemeREX AutoParts <= 1.5.8
Timeline
- 2025-09-19: other: Vulnerability reported by researcher
- 2026-01-12: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD publication date