Elated-Themes Ambient: Local File Inclusion in WordPress theme

Summary

The WordPress theme Ambient up to version 1.7 contains a Local File Inclusion vulnerability (CWE-98). An unauthenticated remote attacker can make the web server load local files of their choice, which can expose sensitive files such as configuration files with credentials. If an included file contains PHP code, it may be executed, which can lead to a full compromise of the website; the attack complexity is rated high.

Affected

• Ambient WordPress theme, version 1.7 and earlier (CNA range: <= 1.7)

Fixed in

• Unknown. No confirmed fixed version; the CVE record advises upgrading to a release above 1.7.
• Lead, not confirmed: ThemeForest changelog version 2.4 (30 October 2025) mentions "Improved theme's security" without naming this CVE.

Workaround

• Ask the vendor or your developer for the fixed version and update to the current ThemeForest release.
• If the theme is not in active use, deactivate it and remove its files.
• Check whether a web application firewall or virtual-patching service covers this vulnerability.
• Review web server logs for unusual parameters on the theme's pages and keep current backups.

Exploitation

• Not known as exploited in the wild. Not listed in CISA KEV.
• CISA SSVC (Vulnrichment): exploitation none, automatable no, technical impact total.
• Patchstack rates the issue high priority and states it is expected to be exploited; no public proof of concept found.

Our recommendation

• Check whether Ambient 1.7 or earlier is installed on any internet-facing WordPress site.
• Remove or deactivate the theme where it is not needed.
• Obtain a confirmed fixed version from the vendor, update, and verify the installed version afterwards.
• Apply a WAF or virtual patch until the fix is confirmed.
• Monitor web server logs for suspicious file path parameters.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• OpenCVE record app.opencve.io
• Strix CVE page www.strix.ai
• HOL Guard CVE page hol.org
• ThemeForest Ambient listing themeforest.net
• Local File Inclusion guidance github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:01.