CVE-2015-9406: Mtheme-Unus Project Mtheme-Unus

High severity, CVSS 7.5. EPSS: 55% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. (dot dot) in the files parameter to css/css.php.

Affected products

• Mtheme-Unus Project Mtheme-Unus: before 2.3 (fixed in 2.3)

Published 2019-09-20. Last modified 2026-06-17.