Vulnerability threat dossier
The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials when the wp-config.php file is read.
VTP analyst assessment
WooCommerce Designer Pro through 1.9.28 allows unauthenticated arbitrary file reads. Reading wp-config.php can expose database credentials. ProjectDiscovery has published Nuclei template coverage, but that does not establish active exploitation.
2 record references and 2 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
No exploitation in the wild is reported in this record.
Template coverage does not show successful execution.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
If you use WooCommerce Designer Pro 1.9.28 or earlier, update or remove the theme.
VTP deterministic assessment
A proof of concept is reported; functional reliability is not established.
EPSS is 0.02; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 1 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
ProjectDiscovery nuclei-templates published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.
ProjectDiscovery Nuclei Templates Releases published evidence linked to CVE-2025-10897.
Original publications
ProjectDiscovery nuclei-templates recorded exploit-tooling coverage changes for 2 CVEs in this pinned revision. 2 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.
New Templates Added: 105 | CVEs Added: 62 | First-time contributions: 12 🔥 Release Highlights 🔥 [ CVE-2026-42167 ] ProFTPD mod_sql - Preauth User Backdoor ( @pussycat0x ) [high] 🔥 [ CVE-2026-41179 ] RClone RC - Command Injection ( @theamanrawat ) [critical] 🔥 [ CVE-2026-41176 ] Rclone RC - Broken Access Control ( @theamanrawat ) [critical] 🔥 [ CVE-2026-40466 ] Apache ActiveMQ - RCE via HTTP Discovery Transport Bypass ( @dhiyaneshdk ) [high] 🔥 [ CVE-2026-39808 ] Fortinet FortiSandbox - Command Injection ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-39363 ] Vite Dev Server - Arbitrary File Read ( @theamanrawat ) [high] 🔥 [ CVE-2026-35029 ] LiteLLM - Arbitrary File Read ( @theamanrawat ) [high] 🔥 [ CVE-2026-33626 ] LMDeploy - Server-Side Request Forgery ( @theamanrawat ) [high] (kev) (vKEV) 🔥 [ CVE-2026-33439 ] OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-33032 ] Nginx UI - Broken Access Control ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-33017 ] Langflow < 1.9.0 - Remote Code Execution ( @himind ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-27174 ] MajorDoMo - Unauthenticated RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-24423 ] SmarterMail - Remote Code Execution ( @jyoti369 ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-4631 ] Cockpit Web Console < 360 - Remote Code Execution ( @dhiyaneshdk ) [critical] 🔥 [ CVE-2026-3844 ] Breeze <= 2.4.4 - Arbitrary File Upload ( @theamanrawat , @ritikchaddha ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-13390 ] WP Directory Kit <= 1.4.4 - Authentication Bypass (@maxthepm) [critical] (kev) (vKEV) 🔥 [ CVE-2021-3152 ] Home Assistant HACS - Local File Inclusion ( @dhiyaneshdk ) [high] 🔥 What's Changed Bug Fixes CI: migrated nuclei GitHub action to native Node.js runtime (PR #16061 , PR #16049 ). Removed duplicate template for BeyondTrust (PR #16024 ). Removed duplicate matcher line in roundcube-log-disclosure.yaml (PR #16042 ). Corrected invalid cve-id classification field values across templates (PR #16023 ). Fixed invalid CPE format strings across templates (PR #15991 , PR #15828 ). Fixed tag formatting in CVE-2024-57727 , CVE-2023-38875 , CVE-2023-24322 (PR #15989 , PR #15897 , PR #15899 ). Corrected YAML formatting in Retool postMessage XSS template (PR #15952 ). Fixed file path for CVE-2026-2262 (PR #15998 ). Renamed joomla-htaccess.yaml → joomla-htaccess-file.yaml for clarity (PR #15987 ). Renamed contrastapi-domain-recon.yaml to correct directory (PR #16025 ). Renamed and updated superset-default-login.yaml (PR #15822 ). Release preparation for Nuclei Templates v10.4.2 (PR #15920 ). False Negatives Fixed FN in tomcat-default-login by ordering payloads to avoid LockOutRealm shunning (PR #16053 , Issue #15382 ). False Positives Reduced false positives and improved accuracy in the following templates: ingress-nginx-valid-admission.yaml — added 200-status guard for verbose-debug PHP frameworks (PR #16046 , Issue #14248 ). CVE-2024-2473 — verify hidden login URL disclosure to avoid FP on WPS Hide Login (PR #15985 , Issue #15871 ). CVE-2019-5544 — fix FP triggered when port 427 is closed (PR #15979 , Issue #15098 ). CVE-2023-45648 — bound Tomcat version regex (PR #15459 , Issue #15566 ). ldap-anonymous-login-detect.yaml — honor Port parameter instead of forcing 389 (PR #15430 , Issue #14736 ). sentry-panel — added title check to prevent FP (PR #15984 ). Enhancements Added Microsoft domain to mx-service-detector (PR #16030 ). Added registrar extractors to rdap-whois template (PR #15908 ). Added references to CVE-2020-15718 (PR #16058 ). Updated mitel-version-detect.yaml (PR #15839 ). Linked CVE-2021-31589 to existing beyond-trust-xss.yaml (Issue #15273 ). Templates Added [ CVE-2026-42167 ] ProFTPD mod_sql - Preauth User Backdoor ( @pussycat0x ) [high] 🔥 [ CVE-2026-42031 ] CKAN DataStore SQL Search - SQL Injection ( @theamanrawat ) [high] [ CVE-2026-41940 ] cPanel & WHM - Auth Bypass via Session-File CRLF Injection ( @wat
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.