High · published January 8, 2026
⚡ PHP Local File Inclusion alert! An improper filename control in ThemeMove Moody could let attackers include files at will — like handing out keys to every room in the building! 🔑 Imagine a hotel receptionist who accepts any name on a guest list and gives out room keys without checking IDs. That’s how this vulnerability operates, allowing an attacker to access any file on the server just by manipulating the file path! An attacker could potentially access sensitive files, manipulate crucial server configurations, or even execute malicious code. This could lead to data breaches, server takeovers, or a complete loss of control over your application. Yikes!
Imagine a hotel receptionist who accepts any name on a guest list and gives out room keys without checking IDs. That’s how this vulnerability operates, allowing an attacker to access any file on the server just by manipulating the file path! This vulnerability arises from improper control of filenames in the PHP include/require statements, allowing attackers to include arbitrary files from the server. Specifically, it affects Moody versions up to and including 2.7.3.
An attacker could potentially access sensitive files, manipulate crucial server configurations, or even execute malicious code. This could lead to data breaches, server takeovers, or a complete loss of control over your application. Yikes! To mitigate this risk, update ThemeMove Moody to the latest version immediately. Additionally, ensure that input handling and filename controls are properly validated to prevent unauthorized file inclusions. Regularly audit your PHP files for secure coding practices! You've got this! Follow these steps, and you’ll have your defenses fortified in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| thememove/moody | ≤ 2.7.3 | — |