Technical impact
WordPress Stargaze theme contains an improper control of filename for an include/require statement, allowing a local file inclusion vulnerability. An attacker can supply a crafted filename that causes the PHP engine to read arbitrary files on the server, potentially exposing sensitive configuration or code. Because the inclusion is executed in the context of the web request, the malicious payload can lead to remote code execution, data exfiltration or further compromise of the site.
Affected Systems
ThemeREX Stargaze theme is affected from its initial release through version 1.5. WordPress installations that use any version of Stargaze up to 1.5 are at risk, unless the theme has been updated to a newer version.
Risk and Exploitability
With a CVSS score of 8.1, this vulnerability is rated high severity. The EPSS score is below 1%, indicating a low probability of current exploitation, and it is not listed in CISA's KEV catalog. However, the vulnerability can be exploited remotely via a public-facing URL that accepts a user-specified file path. Successful exploitation can provide unauthorized access to sensitive data or arbitrary code execution on the server. The lack of an authentication requirement is inferred from the public nature of the parameter used for file inclusion.
