Description
Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
Published: 2026-06-16
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Abelle WordPress theme contains an unauthenticated Local File Inclusion vulnerability in versions 1.22 and earlier. A flaw allows an attacker to request the inclusion of arbitrary local files on the file system. This potentially allows the attacker to read sensitive files or otherwise manipulate the server environment.

Affected Systems

WordPress sites that have installed the ThemeREX Abelle theme version 1.22 or earlier are affected.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% indicates a low probability of public exploitation at this time. The vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on June 17, 2026 at 22:11 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Abelle theme to any version newer than 1.22, if a patch is available from ThemeREX.
  • If upgrading is not possible, disable or remove the Abelle theme from the WordPress installation until a fixed version is released.
  • Check the ThemeREX website or the WordPress plugin directory for updated versions or official security advisories.

Generated by OpenCVE AI on June 17, 2026 at 22:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 26 Jun 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Themerex
Themerex abelle
Wordpress
Wordpress wordpress
Vendors & Products Themerex
Themerex abelle
Wordpress
Wordpress wordpress

Wed, 17 Jun 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 16 Jun 2026 22:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
Title WordPress Abelle theme <= 1.22 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Themerex Abelle
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-06-17T10:48:38.879Z

Reserved: 2025-12-29T11:19:41.704Z

Link: CVE-2025-69142

cve-icon Vulnrichment

Updated: 2026-06-17T10:48:34.320Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-26T09:44:35Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')