Executive brief
ApusTheme Homeo, a WordPress theme used for real estate and property listing websites, contains a security vulnerability that could allow an attacker to access sensitive internal files. By exploiting this flaw, an authorized user with low-level access could potentially view configuration files containing database credentials, leading to a full site takeover. This issue affects all versions of the theme up to and including 1.2.59.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ApusTheme Homeo theme for WordPress (versions <= 1.2.59) due to insufficient validation of user-supplied input used in PHP include or require statements (CWE-98). An attacker with 'Contributor' or higher privileges can manipulate file paths to include local files from the server's filesystem. This can lead to the disclosure of sensitive information, such as the wp-config.php file, which contains database credentials and security keys. While the attack requires authentication and has high complexity, successful exploitation can result in a complete compromise of the confidentiality, integrity, and availability of the affected site. No official patch has been released at the time of this advisory.
Affected products
- ApusTheme Homeo <= 1.2.59
Timeline
- 2026-01-22: other: Vulnerability reported by researcher João Pedro S Alcântara
- 2026-02-21: disclosed: Vulnerability details published by Patchstack
- 2026-04-08: advisory: CVE published to NVD