Executive brief
Freeio, a WordPress theme used for building freelance marketplace websites, contains a security flaw that could allow an attacker to access sensitive internal files. By exploiting this vulnerability, a logged-in user with low-level permissions could potentially view configuration files containing database credentials, leading to a full site takeover. This issue affects all versions of the theme up to and including 1.3.21.
Technical details
The ApusTheme Freeio theme for WordPress (versions <= 1.3.21) is vulnerable to Local File Inclusion (LFI) classified under CWE-98. The vulnerability stems from improper validation of user-supplied input used in PHP include or require statements. An attacker with 'Contributor' level privileges or higher can manipulate file paths to include local files from the server. This can lead to the disclosure of sensitive information, such as the wp-config.php file, or potentially remote code execution if the attacker can upload or find a malicious file on the local file system. As of the advisory date, no official patch has been released.
Affected products
- ApusTheme Freeio <= 1.3.21
Timeline
- 2026-01-22: other: Vulnerability reported by researcher João Pedro S Alcântara
- 2026-02-21: disclosed: Vulnerability details published by Patchstack
- 2026-04-08: advisory: CVE-2026-39679 published in NVD