Security readout for executives and security teams
Plain-English summary
An older WordPress theme can let an attacker make a site page run unwanted browser script when someone opens a malformed URL. The issue is limited to sites using Web Minimalist 200901 before version 1.2. Business urgency depends on whether that theme is still installed or active.
Executive priority
Treat this as a targeted legacy-asset cleanup item. It is not supported by active-exploitation evidence in the bundle, but public-facing WordPress XSS can affect user trust and admin session safety if the old theme remains deployed.
Technical view
Web Minimalist 200901 WordPress theme versions before 1.2 mishandle PATH_INFO for index.php, enabling reflected injection of script or HTML. Impact is browser-side execution in a visitor or admin session, depending on who opens the crafted URL. The bundle provides no CVSS, CWE, exploit maturity, or code-level detail.
Likely exposure
Exposure is likely limited to legacy WordPress sites with the Web Minimalist 200901 theme installed, especially versions earlier than 1.2. Sites not using this theme are not indicated as affected by the supplied sources.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The described attack is remote XSS through PATH_INFO, but the bundle does not include exploit reliability, prevalence, or real-world campaign evidence.
Researcher notes
The CVE record names only the theme and vulnerable input path, not CVSS, CWE, affected CPEs, or detailed remediation notes beyond the fixed-version boundary implied by “before 1.2.” Validate exposure through asset inventory rather than broad product assumptions.
Mitigation direction
- Inventory WordPress sites for the Web Minimalist 200901 theme.
- Update the theme to version 1.2 or later if still required.
- Remove or disable the theme if it is unused or unmaintained.
- Check the vendor advisory for any additional guidance.
Validation and detection
- Confirm whether the theme is installed or active on each WordPress site.
- Verify the installed theme version is 1.2 or later.
- Review web logs for unusual index.php PATH_INFO requests.
- Confirm the theme no longer reflects unsanitized PATH_INFO in rendered pages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2011-3861 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://sitewat.ch/en/Advisories/19CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.