The Cardea theme for WordPress contains an unauthenticated Local File Inclusion flaw (CWE-98) that allows attackers to read arbitrary files from the server by manipulating request parameters. Because no credentials are required, a visitor can craft a request to include system files or configuration files, leading to exposure of sensitive data and, potentially, further credential‑based attacks. The flaw resides in the theme’s handling of file paths and is specifically documented for Cardea versions 2.3 and earlier. The CVSS score of 8.1 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting that there are currently no known widespread exploits but that the risk remains significant due to the lack of authentication required for exploitation.

WordPress Cardea theme, version 2.3 and earlier, developed by CocoBasic.

An attacker can trigger the Local File Inclusion by accessing the theme’s vulnerable endpoint without authentication. The lack of an EPSS metric makes it unclear how often this vulnerability is actively exploited, but the high CVSS score signals a serious threat. The vulnerability is not recognized in the CISA KEV catalog, indicating that it may not have been widely leveraged in the wild yet, yet its impact on confidentiality remains critical.