CVE-2026-94067 in The Voux Plugin
Summary
by MITRE • 10/09/2026
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The identified security flaw represents a critical failure in input validation and path traversal controls within the WordPress theme known as The Voux, specifically affecting versions ranging from initial releases up to version 6.9.5. This vulnerability is categorized under PHP Remote File Inclusion, although the specific description notes an allowance for Local File Inclusion, indicating that the core issue lies in how the application handles file paths passed through include or require statements without adequate sanitization. The root cause of this weakness stems from a lack of proper control over filenames used in dynamic inclusion operations, which is formally classified under CWE-98 Improper Control of Filename for Include Statements within the Common Weakness Enumeration framework. This classification highlights that the software fails to neutralize special elements such as directory separators or relative path sequences like dot-dot-slash before using them in file system operations, thereby allowing an attacker to manipulate the intended execution flow by injecting arbitrary paths.
From a technical perspective, this vulnerability exploits the PHP engine's behavior when processing include and require directives. When user-supplied input is directly concatenated into these statements without rigorous validation or whitelisting of allowed files, it creates an entry point for code injection attacks. In the context of Remote File Inclusion, if the allow_url_include directive is enabled on the target server, an attacker can supply a URL pointing to malicious PHP code hosted on an external server. The vulnerable script then fetches and executes this remote content as part of its own execution environment. Even in scenarios classified strictly as Local File Inclusion, where remote inclusion might be disabled by server configuration, the flaw remains severe because it allows access to sensitive local files such as configuration files containing database credentials or source code that reveals further architectural weaknesses. This capability aligns with the ATT&CK technique of Server Side Request Forgery and potentially Command Injection if the included file leads to arbitrary command execution through subsequent function calls within the parsed PHP context.
The operational impact of this vulnerability is profound, effectively granting an attacker full control over the affected web application's server environment. By successfully exploiting this flaw, a malicious actor can execute arbitrary PHP code with the same privileges as the web server process. This typically results in complete system compromise, allowing for data exfiltration, modification or deletion of critical website files, installation of backdoors such as web shells, and further pivoting into internal network segments if the compromised host is accessible from other parts of the infrastructure. The presence of this vulnerability significantly lowers the barrier to entry for attackers, as it does not necessarily require complex exploitation chains beyond basic HTTP requests with crafted parameters. It undermines the integrity, confidentiality, and availability guarantees expected by users and administrators relying on the WordPress ecosystem for secure content management.
To mitigate this risk, immediate action is required to update The Voux theme to a patched version that addresses these input validation deficiencies. Developers must implement strict whitelisting mechanisms where only predefined, safe file paths are permitted in include or require statements rather than accepting dynamic user input directly. If dynamic inclusion is necessary, the application should validate and canonicalize all path inputs, ensuring they resolve within an expected directory structure and do not contain traversal sequences. Additionally, server-level configurations should enforce allow_url_include being set to off unless absolutely required by specific legacy applications, thereby neutralizing the remote file inclusion vector entirely. Regular security audits and static code analysis tools configured to detect CWE-98 patterns can help identify similar vulnerabilities in custom themes or plugins before they are deployed into production environments, ensuring a more robust defense posture against web application attacks.