PatchSiren

Javo Themes CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH Javo Themes CVE published 2026-10-22

CVE-2017-20287

The Javo Spot WordPress theme before version 3.0.0 is vulnerable to a path traversal attack. This vulnerability allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action in admin-ajax.php. Specifically, attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. T [truncated]