What is the CVSS score of CVE-2025-48290?

CVE-2025-48290 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Kinsley WordPress Theme are affected by CVE-2025-48290?

CVE-2025-48290 is a local file inclusion vulnerability in Kinsley WordPress theme versions 3.4.4 and earlier that permits unauthenticated remote attackers to read arbitrary server files under…

How to fix or mitigate CVE-2025-48290?

Within 24 hours: Identify all WordPress installations using Kinsley theme ≤3.4.4 via admin dashboard or database query; disable the theme and switch to alternative. Within 7 days: Either upgrade Kinsley theme to version >3.4.4 if available, or permanently remove it and select a patched alternative; verify no residual theme files remain in /wp-content/themes/. Within 30 days: Conduct file access logs review for evidence of exploitation (requests to wp-content/themes/kinsley/ with path traversal patterns); restore any exposed configuration files and regenerate database credentials and API keys.

Kinsley WordPress Theme CVE-2025-48290

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:01 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP Local File Inclusion.This issue affects Kinsley: from n/a through <= 3.4.4.

AnalysisAI

Local File Inclusion in Kinsley WordPress theme versions ≤3.4.4 enables remote attackers to read arbitrary server files and potentially execute code through improper filename control in PHP include/require statements. The vulnerability requires high attack complexity (AC:H) but needs no authentication (PR:N), allowing unauthenticated remote exploitation under specific conditions. EPSS score of 0.22% indicates low predicted exploitation probability, with no CISA KEV listing or public exploit code identified at time of analysis.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability (CWE-98) in the Kinsley WordPress theme by bslthemes. Despite the CVE title mentioning 'PHP Remote File Inclusion', available data including Patchstack tags and CWE classification confirm this as LFI. The flaw stems from improper sanitization of user-controlled input passed to PHP include/require statements, allowing attackers to manipulate file paths. In WordPress themes, this commonly occurs in AJAX handlers, template loaders, or asset management functions that dynamically include files based on GET/POST parameters without adequate path traversal protection or whitelist validation. The high attack complexity (AC:H) suggests exploitation requires specific server configurations (such as accessible log files for log poisoning) or knowledge of exact file paths on the target system.

Affected ProductsAI

WordPress Kinsley theme by bslthemes, all versions from initial release through version 3.4.4 inclusive. The vulnerability was reported by Patchstack (audit@patchstack.com) and documented in their WordPress vulnerability database. Organizations can verify installation by checking wp-content/themes/kinsley/style.css for version information. Vendor advisory available at https://patchstack.com/database/Wordpress/Theme/kinsley/vulnerability/wordpress-kinsley-theme-3-4-4-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Kinsley theme to version 3.4.5 or later if a patched release exists (patch availability not confirmed in provided data - verify with bslthemes or Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/kinsley/vulnerability/wordpress-kinsley-theme-3-4-4-local-file-inclusion-vulnerability). If no patch is available, immediately disable the Kinsley theme and switch to a maintained alternative, as WordPress themes can be replaced without site downtime. Compensating controls for organizations unable to switch themes immediately: restrict wp-admin access to trusted IP ranges using .htaccess or firewall rules (reduces attack surface but does not eliminate front-end exploitation vectors), implement Web Application Firewall rules to block common LFI patterns in request parameters (path traversal sequences like '../', null bytes, PHP wrappers like 'php://'), and enable open_basedir PHP directive to restrict file access to WordPress directories only (prevents reading /etc/passwd and other system files but may break legitimate theme functionality - test thoroughly). Monitor web server logs for suspicious file access attempts targeting theme directories. Note that compensating controls provide defense-in-depth but theme replacement or patching is the only complete remediation.