CVE-2026-94067

Executive Summary

CVE-2026-94067 is a PHP Remote/Local File Inclusion vulnerability (CWE-98, "Improper Control of Filename for Include/Require Statement in PHP Program") affecting the Fuelthemes "The Voux" WordPress theme through version 6.9.5. The flaw allows an unauthenticated remote attacker to influence a filename passed to a PHP include/require statement, enabling PHP Local File Inclusion (LFI) on the target server. With a CVSS v3.1 base score of 8.1 (High), successful exploitation permits disclosure of arbitrary readable files and — depending on uploaded-content and log-path conditions — potential escalation to code execution, with High confidentiality and integrity impact.

Technical Analysis

The vulnerability class is precisely defined by CWE-98: the application constructs a path used in a PHP include, include_once, require, or require_once statement without adequately validating or constraining the "filename" component, allowing an attacker to manipulate which file is loaded. The NVD description identifies this instance as a PHP Remote File Inclusion vulnerability mapping that allows PHP Local File Inclusion in versions of The Voux up to and including 6.9.5.

The affected product is a WordPress theme ("The Voux", slug thevoux-wp) distributed by Fuelthemes. Because themes are executed as PHP code within the WordPress runtime on the web server, any user-reachable code path that forwards an attacker-controllable value into an include/require directive is remotely reachable over HTTP(S). The CVSS vector confirms the exposure model:

• AV:N (Network) — the attack is launched over the network; no local access is required.
• AC:H (High) — exploitation is not deterministic; it likely requires satisfying path/parameter conditions, a specific request structure, or the presence of a known file on disk to include.
• PR:N (None) — no authentication is required.
• UI:N (None) — no victim interaction is required.
• S:U (Unchanged) — the exploit does not cross a trust boundary beyond the vulnerable component.
• C:H / I:H / A:H — High confidentiality, integrity, and availability impact, consistent with arbitrary file disclosure and the potential for influencing application behavior via included content.

This is fundamentally a path/file-inclusion defect. The root cause is the absence of an allow-list or canonicalization check on the value that becomes the include target. Two common realization patterns exist in the PHP/WordPress ecosystem: (1) a directly attacker-controlled parameter passed to include/require, and (2) a base-directory-plus-relative-path construction where traversal sequences (e.g., ../) escape the intended directory. Because the CNA title and NVD description do not disclose the exact parameter name, function name, or file path involved, the specific request parameter and code location cannot be stated here and should not be assumed — they must be confirmed by code review of thevoux-wp <= 6.9.5. No specific function, class, endpoint, parameter, or file path from the vulnerable code is asserted in this report, per available data.

A key nuance: the wording "PHP Remote File Inclusion ... allows PHP Local File Inclusion" indicates that while the vulnerability is classified under the RFI family (attacker-influenced include target), the practically demonstrable primitive on standard hardened WordPress hosts is local file inclusion. Modern PHP configurations frequently set allow_url_include=Off, which blocks remote URL inclusion but does not block local path inclusion or directory traversal — hence the LFI outcome. This aligns with the High attack complexity rating: remote code execution via RFI is commonly prevented by configuration, whereas LFI remains achievable.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-94067. The following attack chain is therefore described strictly at the vulnerability-class level and must be validated against a lab instance of The Voux <= 6.9.5.

1. Reconnaissance / target identification. An attacker enumerates internet-facing WordPress sites and fingerprints those running "The Voux" theme (identifiable via theme asset paths and HTML markers such as thevoux references). Because authentication is not required (PR:N), any reachable themed site is a candidate. The attacker confirms the theme version is at or below 6.9.5 to fall within the affected range.

2. Triggering the flaw. The attacker sends a crafted HTTP request that supplies a filename/path value to the code path that performs the PHP include/require operation. The exact request parameter is not disclosed in the available data; per the CWE-98 class, the attacker manipulates the filename component of the include statement so that it resolves to a file of the attacker's choosing rather than the intended file. Directory traversal sequences may be used to reach locations outside the intended directory if the code concatenates a base path with a relative value.

3. Payload/execution at the vulnerability-class level. For LFI, the payload is a path to a sensitive local file on the server (e.g., configuration or credential-bearing files) whose contents are then returned in the response or otherwise reflected by the include behavior. For the RFI variant, the payload would be a URL to a remote resource — but on hosts where remote URL inclusion is disabled, this vector is typically unavailable, which is consistent with the AC:H rating. Attainment of remote code execution via LFI commonly requires supplementary conditions (e.g., the existence of an includable file containing attacker-influenced content), which are environment-dependent and not established by the provided data.

4. Post-exploitation impact. With High confidentiality impact, the attacker can exfiltrate readable application files, potentially exposing database credentials and secrets defined in WordPress configuration. With High integrity impact, inclusion of attacker-influenced content can alter application behavior or, under favorable conditions, yield code execution. High availability impact reflects potential disruption of the affected theme/site.

Because no exploit artifacts are public, defenders should treat exploitation as plausible but not yet observed in the wild based on the intelligence provided.

Impact Assessment

CVE-2026-94067 carries a CVSS v3.1 base score of 8.1 (High). The subscore profile — AC:H, PR:N, UI:N, and C:H/I:H/A:H — describes a remote, unauthenticated, non-interactive attack that, when conditions are met, yields broad confidentiality, integrity, and availability impact on the affected WordPress installation.

• Confidentiality (High): arbitrary local file disclosure can expose configuration files, credential material, and other sensitive data.
• Integrity (High): attacker-influenced file inclusion can modify application logic or content served to users.
• Availability (High): exploitation or malformed include targets can render the theme/site non-functional.

Blast radius. Any WordPress site running The Voux theme at version <= 6.9.5 is exposed. Because themes run in-process with WordPress and share its database and filesystem trust context, compromise of the theme is effectively compromise of the whole site's web tier. Sites that also leverage the theme for e-commerce or membership functionality (The Voux is marketed for content/blogging deployments) risk exposure of user and customer data. Note that High attack complexity (AC:H) tempers the score: not every instance may be exploitable without specific environmental preconditions.

The product is not listed in CISA KEV (exploitation not confirmed in the wild), and no EPSS score has been published by FIRST.org at the time of writing. Absence of KEV and EPSS data does not reduce the technical severity for unpatched, internet-facing installations.

Detection Guidance

Detection should focus on anomalous HTTP requests whose parameters carry path-traversal or file-inclusion indicators, and on server-side file access to sensitive paths. Because the exact vulnerable parameter is unknown, detections below use generic traversal/URL-inclusion patterns applicable to CWE-98. These are heuristic and should be tuned to the environment.

Sigma Rule

title: Potential PHP File Inclusion Attempt Against The Voux Theme (CVE-2026-94067)
id: 3f6c1a2e-9b4d-4e7a-8c1f-94067aabbccd
status: experimental
description: Detects HTTP requests containing path traversal or remote URL inclusion patterns targeting WordPress/The Voux theme, indicative of CWE-98 exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94067
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'GET'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '/etc/passwd'
      - 'php://filter'
      - 'php://input'
      - 'data://'
      - 'expect://'
  selection_remote:
    cs-uri-query|contains:
      - 'http://'
      - 'https://'
      - '//evil'
  selection_theme:
    cs-uri-stem|contains:
      - 'thevoux'
      - 'wp-content/themes'
  condition: selection_method and (selection_traversal or selection_remote) and selection_theme
falsepositives:
  - Legitimate administrative file-management plugins
  - Security scanners and application testing
level: high
tags:
  - attack.t1190
  - cve.2026.94067

YARA Rule

rule CVE_2026_94067_TheVoux_FileInclusion
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects file-inclusion/traversal indicators in web request data related to The Voux theme (CVE-2026-94067, CWE-98)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94067"
        date = "2026-01-01"
        severity = "high"

    strings:
        $theme1 = "thevoux" nocase
        $theme2 = "wp-content/themes/thevoux" nocase
        $trav1  = "../" ascii
        $trav2  = "..%2f" nocase
        $trav3  = "%2e%2e%2f" nocase
        $lfi1   = "php://filter" nocase
        $lfi2   = "php://input" nocase
        $lfi3   = "/etc/passwd" nocase
        $rfi1   = "data://" nocase
        $rfi2   = "expect://" nocase

    condition:
        uint16(0) == 0x4854 or filesize < 2MB and
        (any of ($theme*)) and
        (
            2 of ($trav*) or
            1 of ($lfi*) or
            1 of ($rfi*)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94067 Potential PHP File Inclusion The Voux Theme (CWE-98)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"thevoux"; nocase; http.uri; pcre:"/(\.\.\/|%2e%2e%2f|%2e%2e\/|\.\.%2f|php:\/\/filter|php:\/\/input|\/etc\/passwd|data:\/\/|expect:\/\/)/i"; classtype:web-application-attack; reference:cve,2026-94067; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94067; sid:202694067; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by host.id, source.ip with maxspan=5s
  [ network where
      network.protocol == "http" and
      http.request.method == "GET" and
      http.request.uri : ("*thevoux*" or "*wp-content/themes*") and
      http.request.uri : ("*../*" or "*%2e%2e%2f*" or "*php://filter*" or "*php://input*" or "*/etc/passwd*" or "*data://*" or "*http://*" or "*https://*")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where (match(uri, "thevoux") OR match(uri, "wp-content/themes"))
| where (match(uri, "\.\./") OR match(uri, "%2e%2e%2f") OR match(uri, "php://filter") OR match(uri, "php://input") OR match(uri, "etc/passwd") OR match(uri, "data://") OR match(uri, "expect://"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,cve-2026-94067,">
  <rule id="100940" level="10">
    <if_sid>31100</if_sid>
    <id>^4[0-9]{2}$</id>
    <url>thevoux|wp-content/themes</url>
    <url>\.\./|%2e%2e%2f|php://filter|php://input|etc/passwd|data://|expect://</url>
    <description>CVE-2026-94067: Possible PHP file inclusion/LFI attempt against The Voux theme</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_scan,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, OSV entry, or fixed version has been identified. All guidance below is defensive and general.

1) Immediate mitigations

• Restrict or block the vulnerable include path at the web-application-firewall/reverse-proxy layer: filter request parameters carrying traversal (../, encoded variants) or URL-scheme wrappers (php://, data://, expect://), and normalize/deny such requests before they reach WordPress.
• Enforce PHP configuration hardening: set allow_url_include = Off and allow_url_fopen = Off where feasible to neutralize the remote-inclusion vector; ensure open_basedir restricts file access to the web root.
• If the theme is not required for business function, deactivate and remove The Voux from internet-facing sites. If it is required and no fix exists, consider deploying it behind authentication or a maintenance facade while an alternative is evaluated.

2) Patch/upgrade steps

• There is currently no patch. Monitor the Fuelthemes vendor channel and the NVD/OSV records for CVE-2026-94067 for a fixed release. Track theme version and upgrade immediately when a fix above 6.9.5 becomes available.
• In the interim, do not rely on version-based remediation; validate that any candidate update addresses the include/require input path.

3) Long-term hardening

• Eliminate dynamic include/require targets in custom and vendor theme code; use a strict allow-list mapping of identifiers to fixed files.
• Perform code review of any theme/plugin that passes user input into filesystem operations; adopt PHP coding standards that forbid variable-driven includes.
• Maintain an inventory of WordPress themes/plugins and a patch SLAs; subscribe to vendor and NVD feeds for this product.
• Run least-privilege web server accounts and file-system permissions so that a file-disclosure or inclusion primitive yields minimal secrets.
• Retain WAF logs and web access logs to detect and investigate exploitation attempts.

References

• NVD — CVE-2026-94067: https://nvd.nist.gov/vuln/detail/CVE-2026-94067
• CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program: https://cwe.mitre.org/data/definitions/98.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-94067 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score published for CVE-2026-94067 at time of writing): https://www.first.org/epss/
• Fuelthemes The Voux product page (vendor channel for future advisories/patches): https://fuelthemes.net/

Threat actor campaign data: none available. No exploit-in-the-wild evidence, public proof-of-concept, exploit code, or Nuclei template has been observed for CVE-2026-94067 in the sources reviewed.