What is the CVSS score of CVE-2025-29002?

CVE-2025-29002 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-29002?

A critical file inclusion vulnerability in snstheme Simen versions up to 4.6 could allow attackers to access sensitive files or execute arbitrary code on affected web servers.

How to fix or mitigate CVE-2025-29002?

Within 24 hours: Identify all instances of Simen theme version 4.6 or earlier in your environment and document their criticality. Within 7 days: Implement WAF rules to block suspicious file inclusion patterns, disable dynamic file inclusion features if operationally feasible, and restrict file access permissions. Within 30 days: Plan migration to an alternative theme or await vendor patch; monitor snstheme security advisories closely for patch availability.

PHP CVE-2025-29002

EUVD-2025-18516 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18516

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Simen allows PHP Local File Inclusion. This issue affects Simen: from n/a through 4.6.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in snstheme Simen versions through 4.6 that allows unauthenticated remote attackers to include and execute arbitrary local files via improper control of filename parameters in PHP include/require statements. With a CVSS score of 8.1 and network-based attack vector, this vulnerability enables confidentiality, integrity, and availability compromise; however, the high attack complexity suggests exploitation requires specific conditions or knowledge of the target environment.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a critical weakness in PHP applications where user-supplied input is passed unsanitized to include(), require(), include_once(), or require_once() functions. The snstheme Simen WordPress theme (CPE identifier likely wp:snstheme:simen) fails to properly validate or sanitize filename parameters before inclusion, allowing attackers to reference arbitrary files accessible to the PHP process (e.g., /etc/passwd, wp-config.php, log files, or uploaded malicious files). The distinction between RFI (Remote File Inclusion) and LFI (Local File Inclusion) in the description suggests the vulnerability primarily affects local file access, though depending on PHP configuration (allow_url_include), remote exploitation may be possible.

RemediationAI

Immediate actions: (1) Update snstheme Simen to version 4.7 or later once released (patch version not explicitly provided, so monitor snstheme official releases and WordPress theme repository); (2) If patch unavailable, implement Web Application Firewall (WAF) rules to detect LFI patterns (e.g., directory traversal sequences like '../', 'etc/passwd', PHP wrappers); (3) Disable PHP's allow_url_include directive in php.ini to prevent RFI via wrapper protocols; (4) Restrict PHP execution permissions on user-uploadable directories; (5) Audit logs for suspicious include/require patterns and local file access attempts. Temporary mitigation: Disable or replace the Simen theme with a patched alternative until updates are available.