What is the CVSS score of CVE-2025-15637?

CVE-2025-15637 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Shuffle Theme are affected by CVE-2025-15637?

The Shuffle WordPress theme (versions 1.8 and earlier) contains a high-severity unauthenticated vulnerability allowing attackers to access sensitive server files including database credentials.

How to fix or mitigate CVE-2025-15637?

Within 24 hours: audit all WordPress installations to identify those running Shuffle theme version 1.8 or earlier using plugins like WP Scanner or manual theme inspection via wp-content/themes/. Immediately disable or remove the vulnerable theme, switching to an alternative maintained WordPress theme such as Astra, OceanWP, or Twenty Twenty-Four. Within 7 days: implement Web Application Firewall (WAF) rules to block common LFI patterns (../../../, etc/passwd) on any remaining affected instances during transition, review database access logs for evidence of compromise dating back 30 days, and rotate all database credentials if any signs of unauthorized access are detected. Within 30 days: complete migration of all instances to alternative themes, harden server file permissions (restrict PHP execution in wp-content directories), enable WordPress security monitoring/logging, and conduct database integrity audits to confirm no unauthorized changes occurred.

Shuffle Theme CVE-2025-15637

EUVD-2025-210754 HIGH

PHP Remote File Inclusion (CWE-98)

2026-08-20 Patchstack

GHSA-6fw2-rvrj-mw88

PHP Information Disclosure LFI Shuffle

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-accessible LFI with no auth (AV:N, PR:N), but AC:H reflects complexity needed to achieve full RCE chaining for I:H/A:H impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 12:31 vuln.today

CVE Published

Aug 20, 2026 - 12:06 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

AnalysisAI

Unauthenticated Local File Inclusion (LFI) in the Shuffle WordPress theme by Edge Themes affects all versions up to and including 1.8, allowing a remote attacker without any credentials to force the PHP application to include arbitrary local files from the server. Successful exploitation can expose sensitive files such as wp-config.php (containing database credentials) and, under certain server configurations, escalate to remote code execution via log poisoning or similar chaining techniques. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score and CWE-98 classification indicate a high-severity, high-impact path.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) covers vulnerabilities where attacker-controlled input reaches a PHP include(), require(), or equivalent without adequate sanitization, enabling traversal to arbitrary local file paths. The affected product is the Shuffle theme (CPE: cpe:2.3:a:edge_themes:shuffle:*:*:*:*:*:*:*:*) - a commercial WordPress theme distributed by Edge Themes. WordPress themes execute in the PHP runtime context of the web server process and routinely handle URL or POST parameters that control template or asset loading; when these parameters are not properly sanitized, they can be weaponized as LFI vectors. The CVSS vector AV:N/AC:H indicates the vulnerability is reachable over the network but requires the attacker to overcome some complexity barrier - likely a specific parameter name, path encoding, or PHP configuration requirement such as a writable log path for chaining to RCE.

RemediationAI

The primary remediation is to update the Shuffle theme to a version beyond 1.8 once a patched release is confirmed available from Edge Themes - no exact fixed version number was provided in the available input data, so administrators should consult the vendor directly and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/shuffle/vulnerability/wordpress-shuffle-theme-1-8-local-file-inclusion-vulnerability?_s_id=cve for the confirmed fix version. As an immediate compensating control, restrict public access to the WordPress installation via IP allowlist or Web Application Firewall rules that block path traversal sequences (e.g., ../, %2e%2e%2f, encoded dot-dot-slash variants) targeting the vulnerable parameter identified by Patchstack. Additionally, ensure PHP is configured with open_basedir restrictions to limit the file system paths accessible via include operations, which reduces the blast radius of any LFI exploitation. Disabling allow_url_include in php.ini prevents remote file inclusion chaining, though this does not eliminate local file inclusion. These controls carry trade-offs: WAF rules may produce false positives on legitimate theme requests; open_basedir restrictions may break other plugins or themes if misconfigured.