Werkstatt WordPress theme: Local File Inclusion

Summary

The Werkstatt WordPress theme from Fuelthemes contains a Local File Inclusion flaw (CWE-98) in versions up to and including 4.8.3. An unauthenticated remote attacker can make the website load server files it should not, which can lead to disclosure of sensitive data such as configuration files and, in some cases, a full takeover of the site. Patchstack rates the issue as high priority with a CVSS score of 8.1, but the attack complexity is high and no exploitation has been confirmed yet.

Affected

• Werkstatt WordPress theme, all versions up to and including 4.8.3 (start version unknown)

Fixed in

• Unknown. Patchstack lists 4.8.3 as the last vulnerable version and advises updating to 4.8.3 or later, but its page also states that no official patch was available. No vendor advisory or changelog entry confirming a fix was found.

Workaround

• Patchstack offers a mitigation rule that blocks attacks until an official patch is available (requires a Patchstack subscription).
• If the site cannot be updated, ask the hosting provider or web developer for help.
• Deactivate and remove the theme if it is not in use.
• Place a web application firewall or virtual patch in front of the site.

Exploitation

• No confirmed in-the-wild exploitation found.
• No public proof-of-concept exploit found.
• Not listed in the CISA KEV catalog.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• EPSS about 0.34 percent (low).
• Patchstack expects exploitation, but this is a prediction, not an observation.

Our recommendation

• Check whether any website runs the Werkstatt theme in version 4.8.3 or earlier, including nulled or outdated copies.
• Prioritise internet-facing sites. Remove the theme if it is not needed.
• Apply the Patchstack mitigation or a WAF rule until a verified fixed version is available and tested.
• Check whether files readable by the theme contain database credentials, and rotate them if exposure is possible.
• Review web server logs for unusual requests to the theme.
• Recheck the exploitation status and the fixed version in a few days, because the vendor has not confirmed a patch.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• Patchstack advisory (alternate URL) patchstack.com
• NVD record mirrored by Vulners vulners.com
• CNA/cvelist record mirrored by Vulners vulners.com
• Theme vendor page (ThemeForest) themeforest.net
• Possible duplicate CVE-2025-69314 cyberstrike.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:26.