Fuelthemes The Voux WordPress theme: Local file inclusion
Summary
The Voux WordPress theme up to and including version 6.9.5 contains a local file inclusion vulnerability (CWE-98). An unauthenticated remote attacker can make the site load server files it should not access, which can lead to information disclosure and, in some cases, a full site takeover. The issue is rated 8.1 (High) by the CNA, and the attack is considered highly complex.
Affected
- The Voux WordPress theme (package thevoux-wp), versions up to and including 6.9.5
- Lower bound of the affected range not specified by the CNA
Fixed in
Unknown. No fixed version has been published by the vendor at the time of writing.
Workaround
- Deactivate and remove the theme on sites where it is not actively needed
- Ask your WAF or virtual-patching provider whether a rule covers this issue
- Review server logs for unusual requests to theme files and check web-root files for unexpected changes
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV
- No public proof of concept known
- EPSS about 0.34%
- CISA SSVC: exploitation none, automatable no, technical impact total
- Patchstack expects exploitation and rates the priority as high
Our recommendation
- Inventory all sites running The Voux and their exact theme version, including staging copies and child themes
- For public sites on 6.9.5 or older, treat as high priority: apply mitigation or disable the theme now
- Ask Fuelthemes for the fixed version and monitor the Patchstack advisory
- Replace any nulled or unlicensed copies of the theme
- Keep restorable backups and restrict file permissions
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- Vulners CNA record vulners.com
- Vulners Patchstack record vulners.com
- VulDB entry vuldb.com
- ThemeForest product page themeforest.net
- PSIRT entry psirt.com
- CISA KEV status (GitHub issue) github.com
- Rapid7 via Vulners (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:25.
Original description (NVD)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.