Donpeppe Vulnerabilities

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Don Peppe donpeppe allows PHP Local File Inclusion.This issue affects Don Peppe: from n/a through <= 1.3.

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Mar 5, 2026

CVE-2026-22449 on NVD →

The Don Peppe - Pizza and Fast Food WordPress Theme theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can...

CVSS:

8.1

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Mar 3, 2026

CVE-2026-22449 on NVD →

[en] Missing Authorization vulnerability in Select-Themes Don Peppe donpeppe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Don Peppe: from n/a through <= 1.3.

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Jan 22, 2026

CVE-2026-22450 on NVD →

The Don Peppe theme for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.3

Fix:

No patched version reported

Disclosed:

Jan 3, 2026

CVE-2026-22450 on NVD →