What is the CVSS score of CVE-2025-24768?

CVE-2025-24768 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-24768?

A critical file inclusion vulnerability in the Nitan theme (versions through 2.9) could allow attackers to access sensitive files on affected web servers, potentially exposing confidential data and…

How to fix or mitigate CVE-2025-24768?

Within 24 hours: Identify all systems running Nitan theme version 2.9 or earlier and isolate them from public access or disable the affected functionality. Within 7 days: Contact snstheme for patch availability status and implement Web Application Firewall rules to block file inclusion attempts targeting PHP include/require parameters. Within 30 days: Either upgrade to a patched version when available or migrate to an alternative, actively maintained theme platform.

PHP CVE-2025-24768

EUVD-2025-17480 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17480

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Nitan allows PHP Local File Inclusion. This issue affects Nitan: from n/a through 2.9.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in snstheme Nitan theme affecting versions through 2.9, allowing unauthenticated remote attackers to include and execute arbitrary local files on the server. While the CVSS score of 8.1 indicates high severity with potential for confidentiality, integrity, and availability impact, the attack complexity is marked as HIGH, suggesting exploitation requires specific conditions or server configurations. The vulnerability stems from improper validation of filename parameters in PHP include/require statements (CWE-98), a classic but dangerous class of web application flaws.

Technical ContextAI

The vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a weakness in how PHP applications handle file inclusion. When PHP's include(), require(), include_once(), or require_once() functions receive unsanitized user input as the filename parameter, attackers can traverse the filesystem to include arbitrary files. In this case, the snstheme Nitan WordPress theme fails to properly validate or sanitize filename inputs, allowing Local File Inclusion (LFI). While the CVE description mentions 'Remote File Inclusion' (RFI), the technical details specify LFI, which is the actual vulnerability. LFI attacks typically leverage PHP wrappers (php://filter, php://input) or path traversal sequences (../) to access sensitive files like wp-config.php, /etc/passwd, or application source code. The affected product is identified as snstheme's Nitan theme, likely distributed through WordPress.org or premium channels, affecting WordPress installations running vulnerable versions.

RemediationAI

Upgrade snstheme Nitan to version 2.10 or later (assumed to be available; verify with vendor). No specific patch version provided in data; contact snstheme or check WordPress plugin/theme update mechanism. Mitigation: If immediate patching is not possible: Disable file inclusion features in the theme if configurable; implement Web Application Firewall (WAF) rules to block LFI payloads (e.g., sequences like '../', 'php://', 'phar://'). Mitigation: Harden PHP configuration: Set allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent remote file inclusion vectors. Monitoring: Monitor server logs for suspicious include/require patterns or attempts to access sensitive files (wp-config.php, .env files). Implement file integrity monitoring (FIM) on configuration files. Workaround: Temporarily disable or deactivate the Nitan theme and switch to an alternative theme until patch is available.