LiveActive security incident?Get immediate response
CVE Record

CVE-2015-9406: Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to r...

Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A WordPress theme bug could let an attacker read files from the website server, not just theme assets. The source says mTheme-Unus before 2.3 is affected. Severity and CVSS are not provided, but arbitrary file read can expose configuration or credentials, so prioritize any internet-facing WordPress site still using this theme.

Executive priority

Prioritize this for any public WordPress property using mTheme-Unus. The business risk is data exposure from server-side file reads, especially configuration files. If the theme is absent or at 2.3 or later, urgency drops substantially.

Technical view

CVE-2015-9406 is a directory traversal issue in mTheme-Unus for WordPress before 2.3. The reported vector is the files parameter handled by css/css.php, allowing arbitrary file reads through traversal input. The bundle does not provide CVSS, CWE, affected CPEs, or vendor remediation notes beyond the before-2.3 version boundary.

Likely exposure

Exposure is likely limited to WordPress installations that installed and still serve the mTheme-Unus theme before version 2.3. Public-facing sites are the main concern. The bundle does not identify other affected products, plugins, forks, or hosting-specific exposure conditions.

Exploitation context

The CVE is not listed as KEV, and the bundle does not cite active exploitation. Packet Storm and WPVulnDB references indicate public vulnerability information exists. Treat it as internet-reachable if the vulnerable theme file is accessible, but do not assume ongoing exploitation without separate evidence.

Researcher notes

Evidence is sparse: no CVSS, CWE, CPE, or detailed vendor advisory is included. The defensible scope is mTheme-Unus before 2.3 and the css/css.php files parameter. Avoid expanding affected products or exploit status beyond the cited CVE, Packet Storm, and WPVulnDB references.

Mitigation direction

  • Inventory WordPress sites for the mTheme-Unus theme and installed version.
  • Upgrade mTheme-Unus to version 2.3 or later where still required.
  • Remove or disable the theme if it is unused or cannot be updated.
  • Review vendor or theme maintainer guidance before applying unsupported code changes.
  • Rotate exposed secrets if logs or evidence suggest sensitive files were read.

Validation and detection

  • Confirm whether any production site has mTheme-Unus below version 2.3.
  • Check whether the vulnerable css/css.php endpoint is publicly reachable.
  • Review web logs for traversal-looking requests targeting the theme CSS handler.
  • Assess whether readable server files could expose credentials or application configuration.
  • Document findings, theme versions, and remediation status for each WordPress property.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2015-9406 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.