ThemeREX Ozeum: Unauthenticated Local File Inclusion
Summary
The Ozeum WordPress theme, a theme for art galleries and museum websites, contains an unauthenticated Local File Inclusion vulnerability (CWE-98). According to the CVE record and Patchstack, an attacker can send a crafted request over the network without logging in and make the website load server files it should not access. This can expose sensitive files such as configuration files with credentials, and according to Patchstack it can in some cases lead to a full takeover. The CVSS 3.1 base score is 8.1, with high attack complexity.
Affected
- Ozeum WordPress theme, versions up to and including 1.3.0 (per CVE record and Patchstack)
- The vendor's documentation refers to versions 1.3.4 and lower and to version 2.0.0; this conflicts with the CVE record and is unresolved.
Fixed in
Unknown. No fixed version is confirmed for this CVE. Patchstack lists no official patch.
Workaround
- Unknown. No vendor workaround is documented for this CVE.
- Patchstack offers a mitigation rule (virtual patch) that blocks attacks until an official patch is available.
Exploitation
- No known exploitation at the time of research.
- CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV. EPSS score about 0.003. No public proof of concept found.
- Patchstack states that the vulnerability is expected to be exploited.
Our recommendation
- Check whether any website uses the Ozeum theme and confirm the installed version.
- If the theme is not essential, deactivate or replace it.
- Enable a WAF or virtual patch (for example from Patchstack) to block attacks.
- Install the newest theme release from the vendor or ThemeForest and verify it is above 1.3.0 and the vendor's documented version; ask ThemeREX or Patchstack which version fixes this CVE.
- Review web server logs for unusual file-path parameters and check that configuration files are not readable from the web root.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Vulners (Rapid7) CVE-2026-62074 vulners.com
- OpenCVE CVE-2026-62074 app.opencve.io
- Threatint CVE-2026-62074 cve.threatint.com
- HOL Guard CVE-2026-62074 hol.org
- ThemeREX Ozeum documentation doc.themerex.net
- ThemeForest Ozeum theme themeforest.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:08.
Original description (NVD)
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.