What is the CVSS score of CVE-2025-28992?

CVE-2025-28992 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-28992?

A critical file inclusion vulnerability exists in SNS Anton theme (versions through 4.1) that could allow attackers to read sensitive files or execute arbitrary code on affected WordPress…

How to fix or mitigate CVE-2025-28992?

Within 24 hours: Identify all WordPress installations using SNS Anton theme and document affected systems; immediately implement WAF rules to block malicious file inclusion patterns targeting the vulnerable parameters. Within 7 days: Deploy network segmentation to restrict outbound connections from web servers and apply input validation/sanitization at the application layer; contact SNS theme vendor for patch timeline. Within 30 days: Either update to a patched version when available or migrate to an alternative WordPress theme; conduct forensic review of access logs for exploitation indicators.

PHP CVE-2025-28992

EUVD-2025-17487 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17487

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme SNS Anton allows PHP Local File Inclusion. This issue affects SNS Anton: from n/a through 4.1.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in SNS Anton theme versions up to 4.1 that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability stems from improper input validation on filename parameters in PHP include/require statements (CWE-98), enabling attackers to read sensitive files or achieve remote code execution through log poisoning or other local file abuse techniques. With a CVSS score of 8.1 and network-based attack vector, this represents a critical risk to affected WordPress installations, particularly if actively exploited in the wild or if public proof-of-concept code is available.

Technical ContextAI

This vulnerability exploits improper path traversal controls in PHP's include()/require() language constructs. The SNS Anton WordPress theme (likely a commercial or freemium WordPress theme) fails to properly sanitize or validate user-supplied input before using it in dynamic file inclusion statements. Attackers can leverage directory traversal sequences (e.g., '../../../etc/passwd') or absolute file paths to include arbitrary files from the server filesystem. The root cause is classified under CWE-98 ('Improper Control of Filename for Include/Require Statement in PHP Program'), which represents a class of vulnerabilities where developers construct file paths dynamically without adequate input validation or allowlisting. Modern PHP configurations with disabled functions (allow_url_include) may partially mitigate this, but local file inclusion remains exploitable for information disclosure and, combined with file upload functionality or readable log files, can lead to code execution.

RemediationAI

Immediate Actions: (1) Upgrade SNS Anton theme to version 4.2 or later (patch version unknown from provided data; verify with vendor). (2) If immediate patching is unavailable, consider disabling the SNS Anton theme and switching to an alternative WordPress theme. (3) Review WordPress user roles and temporarily restrict file upload permissions to prevent log poisoning attacks that could enable RCE. Mitigation Measures: (4) Implement PHP-level protections: disable allow_url_include and allow_url_fopen directives if not required. (5) Apply Web Application Firewall (WAF) rules to block requests containing directory traversal patterns ('../', '..\', etc.) in suspicious parameters. (6) Audit web server access logs for indicators of exploitation (multiple 404s on local file paths, unusual include paths). (7) Use WordPress security plugins (e.g., Wordfence, Sucuri) to monitor theme file modifications. Vendor Advisory: Contact snstheme directly or monitor their official channel for patch release; no direct advisory link provided—recommend checking WordPress.org theme page or vendor site for version 4.2+ release notes.