CVE-2026-25027: 
WordPress vulnerability analysis and mitigation

CVE-2026-25027 is a Local File Inclusion (LFI) vulnerability in the ThemeMove Unicamp WordPress theme affecting all versions up to and including 2.7.1. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98). It was reported by researcher João Pedro S Alcântara (Kinorth) on January 5, 2026, and publicly disclosed on February 3–4, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), requiring low privileges and high attack complexity (Patchstack, Feedly).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. An authenticated attacker with at least Contributor-level privileges can manipulate a filename parameter passed to a PHP include() or require() statement within the Unicamp theme, causing the server to include arbitrary local files. The attack is delivered over the network but requires high attack complexity and low-level authentication, limiting opportunistic exploitation. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), potentially enabling complete database takeover. Confidentiality, integrity, and availability are all rated as High impact in the CVSS scoring. Depending on server configuration, LFI may also be chained with log poisoning or other techniques to achieve remote code execution, broadening the potential blast radius beyond simple file disclosure (Patchstack).

No active in-the-wild exploitation has been reported, and no public exploit code or proof-of-concept is currently known. The EPSS score is approximately 0.127%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns, this specific issue is assessed as low priority and unlikely to be exploited imminently (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the Unicamp theme (version ≤ 2.7.1) via passive fingerprinting tools (e.g., WPScan, Shodan) by detecting theme-specific assets in HTTP responses.
2. Obtain low-privilege access: Register or compromise a Contributor or higher-level WordPress account on the target site, as the vulnerability requires authenticated access.
3. Identify vulnerable parameter: Locate the theme functionality that passes user-controlled input to a PHP include() or require() statement — typically via a theme template or shortcode parameter.
4. Craft LFI payload: Submit a request with a manipulated filename parameter (e.g., ../../../../wp-config.php or /etc/passwd) to traverse directories and include a sensitive local file.
5. Retrieve sensitive data: The server renders the included file's contents in the HTTP response, exposing credentials or other sensitive information that can be used for further compromise (Patchstack).

• Network: HTTP requests to WordPress theme endpoints containing directory traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: WordPress or web server access logs showing requests with path traversal patterns targeting theme-related URLs; PHP error logs referencing unexpected file inclusion paths.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or server configuration files correlating with suspicious request times.
• Process: PHP processes reading files outside the WordPress web root directory, observable via system audit logs (e.g., auditd on Linux).

The vendor has released version 2.7.2 of the Unicamp theme, which patches this vulnerability. Site administrators should update to version 2.7.2 or later immediately via the WordPress theme update mechanism. If an immediate update is not possible, restricting Contributor-level user registration and limiting untrusted user roles can reduce the attack surface. Web application firewalls (WAFs) with rules targeting path traversal patterns can provide an additional layer of defense in the interim (Patchstack).

Wordfence included this vulnerability in its weekly WordPress vulnerability report covering February 2–8, 2026, highlighting it as part of broader WordPress ecosystem security monitoring (Wordfence). Patchstack, which coordinated the disclosure, assessed the issue as low priority with limited immediate exploitation risk. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database aggregation has been observed.