EUVD-2025-17482CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Inset allows PHP Local File Inclusion. This issue affects Inset: from n/a through 1.18.0.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in AncoraThemes Inset theme affecting versions through 1.18.0, allowing unauthenticated remote attackers to include and execute arbitrary local files on vulnerable servers. This CWE-98 vulnerability stems from improper control of filename parameters in PHP include/require statements, with a CVSS score of 8.1 (High) reflecting significant confidentiality, integrity, and availability impact. The moderate attack complexity (AC:H) suggests exploitation requires specific conditions or knowledge, though the network-accessible attack vector (AV:N) and lack of privilege requirements (PR:N) make this practically exploitable.
Technical ContextAI
The vulnerability exists in the AncoraThemes Inset WordPress theme (CPE identifier: vendor:ancorathem*:product:inset) and represents a classic PHP file inclusion flaw (CWE-98). The root cause involves improper input validation on filename parameters passed to PHP's include() or require() statements, likely in template processing or configuration loading functions. PHP Local File Inclusion (LFI) differs from Remote File Inclusion (RFI) in that it accesses files already present on the server; attackers exploit path traversal sequences (e.g., ../../../etc/passwd) or null bytes to access sensitive configuration files, source code, or system files. This is particularly dangerous in WordPress themes because they often handle user-supplied parameters without strict sanitization. The vulnerability affects Inset versions from an unspecified baseline through 1.18.0, suggesting the flaw has existed across multiple releases.
RemediationAI
Update AncoraThemes Inset to version 1.18.1 or later (specific version number not provided in references; consult vendor advisory for exact patched release). Update via WordPress dashboard (Appearance > Themes > Inset > Update if available) or via direct download from AncoraThemes. Immediate Workaround: If patch unavailable, deactivate Inset theme temporarily and switch to a maintained alternative theme pending vendor patch availability. Server-Level Mitigation: Configure PHP settings: ensure allow_url_include is disabled (default), set open_basedir to restrict file access scope, and disable remote stream wrappers if not required. Apply Web Application Firewall (WAF) rules to block common LFI traversal patterns (../../../, ..), encoded variants (%2e%2e), and null byte sequences (%00). Detection & Monitoring: Monitor web server access logs for suspicious URL patterns targeting Inset theme files with path traversal sequences or unusual file parameters. Enable WordPress security audit logging via plugins (e.g., Wordfence, Sucuri) to capture exploitation attempts. Access Control: Restrict theme file exposure: disable direct access to theme files via .htaccess rules (e.g., deny direct access to sensitive theme directories), and implement strict input validation in any custom WordPress code interacting with user-supplied file parameters.
Share
External POC / Exploit Code
Leaving vuln.today