What is the CVSS score of CVE-2025-24761?

CVE-2025-24761 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-24761?

A critical file inclusion vulnerability in the snstheme DSK plugin (versions through 2.2) allows attackers to access sensitive local files on affected systems, potentially exposing credentials,…

How to fix or mitigate CVE-2025-24761?

Within 24 hours: Inventory all systems running snstheme DSK and assess exposure; implement network-level access controls to restrict plugin functionality. Within 7 days: Disable or remove the vulnerable DSK plugin if not business-critical; if retention is necessary, apply Web Application Firewall rules to block file inclusion patterns. Within 30 days: Monitor vendor communications for patch availability; upgrade to patched version immediately upon release or implement permanent alternative solution.

PHP CVE-2025-24761

EUVD-2025-27723 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-27723

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK allows PHP Local File Inclusion. This issue affects DSK: from n/a through 2.2.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in the snstheme DSK WordPress theme (versions up to 2.2) that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability stems from improper input validation on filename parameters in PHP include/require statements, potentially enabling attackers to read sensitive files, execute code, or compromise the entire WordPress installation. This is a high-severity issue (CVSS 8.1) affecting a popular theme, though real-world exploitation requires moderate attack complexity (AC:H).

Technical ContextAI

The vulnerability exists in the snstheme DSK WordPress theme (CPE identifier likely: cpe:2.3:a:snstheme:dsk:*:*:*:*:*:wordpress:*:*) and represents a classic PHP Remote/Local File Inclusion (RFI/LFI) weakness categorized under CWE-98 ('Improper Control of Filename for Include/Require Statement in PHP Program'). The root cause is insufficient validation of user-supplied input before it is passed to PHP's include(), require(), include_once(), or require_once() functions. Attackers can manipulate file paths through GET/POST parameters or cookies to access files outside the intended directory scope, leveraging directory traversal sequences (../) or null-byte injection (in older PHP versions) to bypass path restrictions. The vulnerability affects DSK versions from an unspecified baseline through version 2.2, indicating the flaw has existed in the theme for multiple releases.

RemediationAI

Update snstheme DSK to version 2.3 or later (assumed fix version based on '≤ 2.2' language; verify with vendor advisory); priority: Immediate Vendor Advisory: Check snstheme official website or WordPress.org theme repository for security advisory and patch release notes; link: https://wordpress.org/themes/dsk/ (assumed repository URL) Workaround (if patch unavailable): Implement Web Application Firewall (WAF) rules to block requests containing directory traversal patterns (../, ..\ null-bytes, or suspicious file paths like /etc/passwd, wp-config.php) in user input parameters Mitigation: Disable theme if not critical; use alternative theme from verified developers; restrict access to theme files via .htaccess or nginx configuration Detection: Scan server logs for requests with encoded traversal sequences (%2e%2e%2f) or file path parameters; use WordPress security plugins (e.g., Wordfence, Sucuri) to detect/block exploitation attempts