CVE-2015-9406: mTheme-Unus WordPress theme path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityUnauthenticated remote file read with a high EPSS score and public exploit references, though it is not in KEV and only affects confidentiality.

What it is

The mTheme-Unus theme before 2.3 for WordPress contains a directory traversal flaw in css/css.php. The files parameter accepts .. sequences, letting a remote attacker read files outside the intended directory. Because the theme is publicly reachable and the request needs no credentials, any exposed installation is at risk.

Impact

An attacker can read arbitrary files on the web server, including configuration files such as wp-config.php, which may expose database credentials and other secrets. This is a confidentiality-only issue; no code execution or data modification is granted by the flaw itself.

Attack surface

Reached over the network through an HTTP request to css/css.php with a crafted files parameter. The CVSS vector shows no privileges required and no user interaction, so the endpoint is directly callable by an unauthenticated remote client.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.55 (98.9th percentile), and the Packet Storm reference is tagged Exploit, indicating public exploit material exists. No ransomware usage is documented.

What to do

• Update the mTheme-Unus theme to version 2.3 or later, or remove the theme if it is no longer maintained.
• If patching is not immediately possible, block or restrict access to css/css.php and reject requests containing .. sequences.
• Deploy a WAF rule that normalizes and blocks path traversal patterns in query parameters.
• Audit the web root for exposed secrets and rotate any credentials found in readable files such as wp-config.php.

Detection

• Search web server logs for requests to css/css.php with .. or encoded traversal sequences in the files parameter.
• Alert on HTTP 200 responses to css/css.php requests whose parameters contain path traversal patterns.
• Monitor for outbound or repeated reads of sensitive files like wp-config.php from the web process.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.