What is the CVSS score of CVE-2025-39466?

CVE-2025-39466 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dør WordPress Theme are affected by CVE-2025-39466?

The Dør WordPress theme versions 2.4 and earlier contain a local file inclusion vulnerability that allows attackers to read sensitive files from the server, potentially exposing database credentials,…

How to fix or mitigate CVE-2025-39466?

Within 24 hours: identify all WordPress installations using Dør theme and document current version via wp-admin or file system inspection. Within 7 days: contact theme vendor for patch availability status; if unavailable, deactivate and remove Dør theme versions ≤2.4, replacing with alternative theme from WordPress.org repository. Within 30 days: conduct file access logs review for suspicious patterns indicative of exploitation (requests with path traversal sequences like ../ or PHP wrapper protocols), and rotate all credentials stored in wp-config.php and database configuration files.

Dør WordPress Theme CVE-2025-39466

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:08 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.

AnalysisAI

Local file inclusion in Dør WordPress theme versions ≤2.4 allows remote attackers to read arbitrary files on the server and potentially achieve code execution through PHP wrapper manipulation. Despite the vulnerability title mentioning 'Remote File Inclusion', the CWE-98 classification and 'PHP Local File Inclusion' description indicate the actual vulnerability enables local file reads. Reported by Patchstack audit team with CVSS 8.1 severity, though EPSS probability of 0.14% (35th percentile) suggests limited observed exploitation activity. No CISA KEV listing indicating no confirmed widespread active exploitation at time of analysis.

Technical ContextAI

The vulnerability exploits improper validation of file paths in PHP include/require statements within the Dør WordPress theme by Qode Interactive (formerly Mikado-Themes). CWE-98 describes unsafe handling of filenames in include statements where user-controlled input influences which file gets loaded. The theme fails to sanitize file path parameters, allowing directory traversal sequences or direct file path manipulation. Affected product identified via CPE cpe:2.3:a:qodeinteractive:dor:*:*:*:*:*:wordpress:*:* encompasses all versions up to and including 2.4 running on WordPress platforms. PHP file inclusion vulnerabilities become critical when attackers can leverage PHP stream wrappers (php://input, php://filter) or chain with file upload features to escalate from file disclosure to remote code execution.

RemediationAI

Upgrade Dør WordPress theme to version 2.5 or later if available, verifying through the Qode Interactive official theme marketplace or WordPress theme update mechanism. Consult Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/dor/vulnerability/wordpress-doer-2-4-local-file-inclusion-vulnerability?_s_id=cve for confirmed patched version details as exact fix version not independently verified in available data. If immediate upgrade is not feasible, implement compensating controls: disable the Dør theme and switch to a secure alternative theme until patching is completed; configure web application firewall rules to block requests containing directory traversal sequences (../, ..\ patterns) and PHP wrapper protocols (php://filter, php://input) in URL parameters and POST data targeting theme endpoints; restrict file system permissions to prevent WordPress process from reading sensitive files outside the web root; enable PHP open_basedir directive to confine file operations to WordPress installation directory. Note that WAF rules may interfere with legitimate file upload or media management features and should be tested in staging environments. Audit web server logs for exploitation attempts showing patterns like path traversal or unusual file parameter values accessing the theme directory.