Description
Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.
Published: 2026-08-13
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The flaw resides in the AI Hub theme, where an improper validation of file paths in the download handler permits a client to obtain any file stored on the server. If accessed, this could expose configuration files, credentials, or other sensitive data, and may be exploited further if the downloaded files contain executable content. The weakness corresponds to CWE‑22: Path Traversal.

Affected Systems

Any WordPress site using the LiquidThemes AI Hub theme version 1.3.10 or earlier.

Risk and Exploitability

The CVSS score of 7.7 indicates a high impact vulnerability. The EPSS score is not available and the flaw is not listed in CISA KEV, so public exploitation rates are uncertain. Likely, a remote attacker could send a crafted HTTP request to the vulnerable download endpoint; the description does not specify authentication requirements, so the attack vector may require or not require credentials, which is inferred from the typical WordPress file‑download functionalities.

Generated by OpenCVE AI on August 13, 2026 at 16:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the AI Hub theme to the latest release that removes the vulnerable download functionality (a version greater than 1.3.10).
  • If an immediate upgrade is not possible, modify the theme’s download handler to enforce strict path validation or restrict the endpoint to authenticated users only.
  • Deploy or configure a web application firewall rule that blocks requests containing path traversal patterns such as "../" or suspicious file paths when accessing the download endpoint.

Generated by OpenCVE AI on August 13, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Liquidthemes
Liquidthemes ai Hub
Wordpress
Wordpress wordpress
Vendors & Products Liquidthemes
Liquidthemes ai Hub
Wordpress
Wordpress wordpress
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 13 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.
Title WordPress AI Hub theme <= 1.3.10 - Arbitrary File Download vulnerability
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

Liquidthemes Ai Hub
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-13T15:48:05.979Z

Reserved: 2026-07-22T08:54:37.139Z

Link: CVE-2026-65582

cve-icon Vulnrichment

Updated: 2026-08-13T14:25:03.129Z

cve-icon NVD

Status : Received

Published: 2026-08-13T14:17:04.320

Modified: 2026-08-13T16:18:36.323

Link: CVE-2026-65582

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T16:30:03Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')