Description
Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.
Published: 2026-06-16
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated Local File Inclusion flaw exists in the Corbesier WordPress theme up to version 1.15.0, classified as CWE-98. The vulnerability allows an attacker to request the inclusion of arbitrary files from the site's local filesystem. If a crafted file containing malicious code is included, the attacker could execute code on the server, leading to full compromise of the WordPress installation.

Affected Systems

The weakness affects ThemeREX Corbesier versions 1.15.0 and older. Use of the Corbesier theme prior to 1.15.1 exposes the site to this flaw, regardless of the WordPress core version.

Risk and Exploitability

The CVSS score of 8.1 marks this as a high‑severity flaw. The EPSS score of less than 1% indicates that exploitation is uncommon in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the inclusion by sending a specially crafted request to a vulnerable site; authentication is not required.

Generated by OpenCVE AI on June 17, 2026 at 20:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Corbesier theme to any version newer than 1.15.0 to remove the vulnerable file inclusion code.
  • If an upgrade cannot be performed immediately, disable or delete the Corbesier theme from the WordPress installation to eliminate the attack surface.
  • Restrict file system permissions for directories accessed by WordPress so that only necessary files are readable, minimizing the risk of unintended file exposure.

Generated by OpenCVE AI on June 17, 2026 at 20:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 23 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
First Time appeared Themerex
Themerex corbesier
Wordpress
Wordpress wordpress
Vendors & Products Themerex
Themerex corbesier
Wordpress
Wordpress wordpress

Wed, 17 Jun 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 16 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.
Title WordPress Corbesier theme <= 1.15.0 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Themerex Corbesier
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-17T10:51:08.212Z

Reserved: 2025-12-29T11:19:31.911Z

Link: CVE-2025-69119

cve-icon Vulnrichment

Updated: 2026-06-17T10:51:02.510Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-23T21:04:23Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')