Forsak3N

**Name of the Vulnerable Software and Affected Versions** Bootstrap Ultimate theme for WordPress versions up to and including 1.4.9 **Description** The issue allows unauthenticated attackers to include PHP files on the server via the `path` parameter, enabling the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution, especially if PHP files can be uploaded and included. If `php://filter` is enabled on the server, this issue may directly lead to Remote Code Execution. **Recommendations** For versions up to and including 1.4.9, consider disabling the `path` parameter to prevent exploitation until a patch is available. Restrict access to sensitive PHP files to minimize the risk of code execution. Avoid using the `path` parameter in API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.