WordPress AirSupply Theme <= 2.0.0 High Priority Local File Inclusion Vulnerability

Vulnerability Overview Vulnerability Name: Local File Inclusion (LFI) vulnerability in WordPress AirSupply Theme <= 2.0.0, rated High Priority Priority: High Priority Affected Versions: <= 2.0.0 Official Patch: No official patch is available Impact Scope Risk Level: CVSS 8.1 Potential Impact: - Attackers can include local files from the target website and display their output on the screen. - Files containing credentials (such as database credentials) may be exposed, potentially leading to database compromise. - This vulnerability has been widely exploited in large-scale attack campaigns, regardless of the website's traffic volume or popularity. Remediation Immediate Action: Update the affected plugin. If updating is not possible, contact your hosting provider or website developer for assistance. Patchstack Solution: - Patchstack has released mitigation rules that can block any attacks until an official patch becomes available. - It is recommended to apply this mitigation rule as soon as possible to ensure website security. Additional Details Software: AirSupply Type: Theme Affected Versions: <= 2.0.0 CVSS Score: 8.1 Reporter: Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) Report Date: October 16, 2025 Timeline Report Date: October 16, 2025 Other Information Patchstack Service: Provides rapid vulnerability mitigation services to ensure website security. Subscription: Weekly WordPress security intelligence can be subscribed to. Code Block POC Code / Exploit Code: No specific POC code or exploit code is provided in the page. --- Summary: The WordPress AirSupply Theme <= 2.0.0 contains a high-priority Local File Inclusion (LFI) vulnerability, which may lead to the exposure of sensitive information and database compromise. It is recommended to update the plugin immediately or apply Patchstack’s mitigation rules.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress AirSupply Theme <= 2.0.0 High Priority Local File Inclusion Vulnerability