An inactive theme is a WordPress theme that is installed on disk but not currently enabled on the site. It may still include templates, PHP files, assets, and configuration code, even though visitors are not using it for the live front end. In WordPress, “inactive” does not mean “gone”; it only means the theme is not the one serving pages right now.
Inactive themes matter because attackers can still target the files they contain. If a vulnerable theme remains on the server, its code may be reachable through preview, installation, update, backup, or file inclusion flaws, even before activation. Defenders should treat inactive themes as part of the attack surface: remove ones that are not needed, keep the rest patched, and review the contents of wp-content/themes/ for unexpected changes. Reducing unused code lowers the chance that a dormant theme becomes a path to server-side execution.