Executive brief
The ChapterOne theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to access sensitive files on the web server. By exploiting this vulnerability, an attacker could view internal configuration files, potentially exposing database credentials and leading to a full site takeover. This issue affects all versions of the theme up to and including 1.7.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the ChapterOne WordPress theme due to improper control of filenames in PHP include/require statements (CWE-98). The flaw allows an unauthenticated remote attacker to manipulate input to include local files from the server's filesystem. While the attack complexity is rated as high, a successful exploit can lead to the disclosure of sensitive information such as wp-config.php, which contains database credentials. The vulnerability is addressed in version 1.8 of the theme.
Affected products
- Mikado-Themes ChapterOne <= 1.7
Timeline
- 2026-02-10: other: Vulnerability reported by researcher
- 2026-04-16: advisory: Initial disclosure by Patchstack
- 2026-06-17: disclosed: CVE published to NVD