What is the CVSS score of CVE-2025-48090?

CVE-2025-48090 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Blanka WordPress Theme are affected by CVE-2025-48090?

CVE-2025-48090 is a path traversal vulnerability in Blanka WordPress theme versions before 1.5 that allows unauthenticated attackers to include arbitrary PHP files, potentially leading to remote code…

How to fix or mitigate CVE-2025-48090?

Within 24 hours: Identify all WordPress installations using Blanka theme and document current versions. Within 7 days: Update Blanka WordPress theme to version 1.5 or later on all affected sites; if updating is not immediately possible, disable or remove the theme and apply a security-hardened alternative. Within 30 days: Conduct a web application firewall review to ensure path traversal patterns ('.../...//', directory traversal sequences) are blocked at the perimeter, and perform server-side file access logging to detect exploitation attempts.

Blanka WordPress Theme CVE-2025-48090

HIGH

Path Traversal: '.../...//' (CWE-35)

2025-11-06 audit@patchstack.com

WordPress Path Traversal PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:02 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.2 (HIGH) 8.1 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

HIGH 8.2

DescriptionCVE.org

Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5.

AnalysisAI

Path traversal in Blanka WordPress theme versions before 1.5 enables unauthenticated remote attackers to include arbitrary PHP files from the server filesystem via malformed directory sequences ('.../...//'). Despite high CVSS 8.1, real-world exploitation requires specific server conditions (attack complexity high). EPSS score of 0.07% (20th percentile) indicates low observed exploitation likelihood. No CISA KEV listing or public POC identified at time of analysis, suggesting limited active targeting despite theoretical severity.

Technical ContextAI

This is a path traversal vulnerability (CWE-35: Path Traversal: '.../.../') in a WordPress theme. The flaw allows attackers to bypass typical directory traversal filters by using non-standard path sequences ('.../...//' instead of common '../') to navigate the filesystem. When successfully exploited, this becomes a Local File Inclusion (LFI) vulnerability allowing inclusion of arbitrary PHP files. WordPress themes process user input for template loading and asset serving; insufficient sanitization of file path parameters permits traversal outside intended directories. The vulnerability exists in the Blanka theme's file handling code, likely in asset loading, template processing, or AJAX handlers. CPE applicability: cpe:2.3:a:cocobasic:blanka:*:*:*:*:*:wordpress:*:* versions below 1.5.

Affected ProductsAI

CocoBasic Blanka One Page WordPress Theme versions from earliest release through version 1.4.x are confirmed vulnerable per NVD CPE data. The vulnerability was addressed in version 1.5 according to Patchstack advisory. Affected installations are WordPress sites running Blanka theme versions below 1.5. Vendor advisory and patch details available at Patchstack database: https://patchstack.com/database/Wordpress/Theme/blanka-wp/vulnerability/wordpress-blanka-one-page-wordpress-theme-theme-1-5-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Blanka WordPress theme to version 1.5 or later immediately. Download patched version through WordPress theme repository or directly from CocoBasic. Complete upgrade process: backup site, deactivate theme if possible, upload version 1.5, verify functionality, clear all caches. If immediate upgrade is not feasible, implement defense-in-depth compensating controls: configure web application firewall (WAF) rules to block requests containing unusual path traversal patterns ('.../...//', encoded variants, repeated dots); enable PHP open_basedir restrictions to confine file access to WordPress installation directory and uploads folder (note: may break legitimate plugins requiring broader filesystem access); audit and restrict file permissions so web server user cannot read sensitive system files outside WordPress directories; implement request logging for theme file paths to detect exploitation attempts. All workarounds reduce but do not eliminate risk - upgrading to 1.5 is the only complete remediation. Advisory reference: https://patchstack.com/database/Wordpress/Theme/blanka-wp/vulnerability/wordpress-blanka-one-page-wordpress-theme-theme-1-5-local-file-inclusion-vulnerability.