What is the CVSS score of CVE-2025-39463?

CVE-2025-39463 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dessau WordPress Theme are affected by CVE-2025-39463?

CVE-2025-39463 is a local file inclusion vulnerability in Dessau WordPress theme versions up to 1.8 that allows authenticated users with low privileges to read arbitrary server files, including…

How to fix or mitigate CVE-2025-39463?

Within 24 hours: Inventory all WordPress installations using Dessau theme and document current versions. Within 7 days: Disable or remove Dessau theme from all installations; migrate to an alternative theme or contact Dessau developers for status on patched versions. Within 30 days: Audit access logs for suspicious file inclusion attempts; reset credentials for any accounts accessible via theme configuration files; implement file integrity monitoring on sensitive server paths and implement principle of least privilege for WordPress user roles.

Dessau WordPress Theme CVE-2025-39463

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:09 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 7.5 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Dessau dessau allows PHP Local File Inclusion.This issue affects Dessau: from n/a through < 1.9.

AnalysisAI

Local file inclusion in the Dessau WordPress theme (versions up to 1.8) enables authenticated attackers with low-level privileges to read arbitrary files from the server filesystem via manipulated file inclusion paths. With attack complexity rated high (AC:H), successful exploitation requires specific conditions but grants access to sensitive configuration files, credentials, and potentially enables further attacks including remote code execution if combined with log poisoning or file upload capabilities. EPSS exploitation probability is low (0.14%, 35th percentile) with no confirmed active exploitation or public proof-of-concept code identified at time of analysis.

Technical ContextAI

This vulnerability stems from improper validation of user-supplied input in PHP file inclusion functions (include, require, include_once, or require_once), classified as CWE-98 (Improper Control of Filename for Include/Require Statement). Despite the CVE title referencing 'Remote File Inclusion,' the vulnerability is actually Local File Inclusion (LFI) as confirmed by tags and Patchstack classification. The Dessau WordPress theme, distributed by Select-Themes, fails to sanitize file path parameters before passing them to PHP inclusion statements. Attackers can manipulate these paths using directory traversal sequences (../) or absolute paths to include arbitrary local files. In WordPress environments, common targets include wp-config.php (database credentials), .htaccess files, system logs, and other sensitive configuration files. The affected product is specifically the Dessau WordPress theme running on PHP-based WordPress installations.

Affected ProductsAI

The vulnerability affects the Dessau WordPress theme developed by Select-Themes, specifically all versions from initial release through version 1.8. Version 1.9 contains the fix. This is a commercial or premium WordPress theme, not distributed through the official WordPress.org theme repository based on the Select-Themes attribution. Organizations can verify their installation by checking the theme version in WordPress admin dashboard under Appearance > Themes, or by inspecting the style.css file in the theme directory for version information. The Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/dessau/vulnerability/wordpress-dessau-theme-1-9-local-file-inclusion-vulnerability provides vendor-specific details and detection signatures.

RemediationAI

Immediately upgrade the Dessau WordPress theme to version 1.9 or later, which contains vendor-released patches addressing the file inclusion vulnerability. Theme updates can typically be performed through the WordPress admin dashboard (Appearance > Themes > Update) if automatic updates are configured, or by manually downloading version 1.9+ from Select-Themes and uploading via FTP/SFTP to the wp-content/themes/dessau directory. Before upgrading, create full backups of the theme directory and database to enable rollback if compatibility issues arise. If immediate patching is not feasible, implement these compensating controls with noted limitations: (1) Restrict WordPress user registration and revoke unnecessary contributor/author-level accounts, reducing the PR:L attack prerequisite-this provides defense-in-depth but does not eliminate risk from compromised accounts. (2) Deploy web application firewall (WAF) rules to detect and block directory traversal patterns (../, absolute paths, null bytes) in request parameters-effectiveness depends on WAF signature quality and may cause false positives requiring tuning. (3) Enable PHP open_basedir restrictions in php.ini or .htaccess to confine file operations to WordPress directories-note this may break legitimate theme functionality requiring testing in staging environment first. (4) Implement file integrity monitoring (FIM) on sensitive files like wp-config.php to detect unauthorized access attempts-provides detection not prevention. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/dessau/vulnerability/wordpress-dessau-theme-1-9-local-file-inclusion-vulnerability for additional vendor-specific guidance and indicators of compromise.