Volos WordPress theme: Unauthenticated Local File Inclusion
Summary
The Volos WordPress theme up to version 1.2 contains an unauthenticated Local File Inclusion vulnerability. An remote attacker without an account can make the website load local server files, which may expose sensitive files such as configuration files with database credentials and in some cases lead to a full takeover. Exploitation requires high attack complexity, and no public proof of concept was found; CISA rates exploitation as none so far.
Affected
- Volos WordPress theme, versions 1.2 and earlier
- Product mapping to the ThemeForest item by CocoBasic is inferred and should be confirmed by checking the installed theme folder (volos-wp) and author
Fixed in
Unknown. No fixed version or vendor advisory was found.
Workaround
- If no fixed version is available, deactivate or delete the Volos theme
- A WAF or Patchstack mitigation rule may reduce exposure, but no vendor-validated rule was found
Exploitation
- Attack vector is network-based, requires no privileges and no user interaction, but has high attack complexity
- CISA SSVC: exploitation none, not automatable
- No public proof of concept found; not listed as known exploited in the sources checked
- EPSS 0.00338 (very low)
Our recommendation
- Inventory WordPress sites for the Volos theme (folder volos-wp or volos-wp-child)
- If present, especially on internet-facing sites, deactivate or replace the theme unless CocoBasic publishes a fixed version
- Check the vendor changelog and Patchstack page for updates
- Keep WordPress core and other plugins and themes up to date
- Monitor web server logs for file inclusion attempts
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- OpenCVE CVE-2026-62066 app.opencve.io
- Vulners RAPID7 record vulners.com
- HOL Guard CVE-2026-62066 hol.org
- ThemeForest Volos item themeforest.net
- CocoBasic support article cocobasic.ticksy.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:05.
Original description (NVD)
Unauthenticated Local File Inclusion in Volos <= 1.2 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.