What is the CVSS score of CVE-2025-49254?

CVE-2025-49254 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49254?

A critical PHP file inclusion vulnerability affects thembay Nika theme versions through 1.2.8, potentially allowing attackers to access sensitive files or execute arbitrary code on affected WordPress…

How to fix or mitigate CVE-2025-49254?

Within 24 hours: Audit all systems running thembay Nika to identify affected versions and document exposure. Within 7 days: Implement WAF rules to block suspicious file inclusion attempts, apply input validation on theme parameters, and consider temporarily disabling affected functionality if operationally feasible. Within 30 days: Plan upgrade to a patched version when released, migrate to an alternative theme if no patch timeline is provided, or maintain heightened monitoring with compensating controls until remediation is available.

PHP CVE-2025-49254

EUVD-2025-18644 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-17 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18644

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika allows PHP Local File Inclusion. This issue affects Nika: from n/a through 1.2.8.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in thembay Nika theme versions through 1.2.8, caused by improper control of filename parameters in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this vulnerability over the network to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or system compromise. The CVSS score of 8.1 (High) reflects significant confidentiality and integrity impact, though the AC:H (Attack Complexity: High) rating suggests some exploitation difficulty; KEV status and active exploitation data would further clarify immediate risk priority.

Technical ContextAI

This vulnerability exploits improper input validation in PHP file inclusion mechanisms (include(), require(), include_once(), or require_once() statements). CWE-98 specifically addresses the failure to properly sanitize or validate user-supplied input before using it as a filename parameter in these statements. In the thembay Nika WordPress theme (CPE likely: cpe:2.3:a:thembay:nika:*:*:*:*:*:wordpress:*:*), an attacker can manipulate HTTP request parameters to include arbitrary file paths—such as /etc/passwd (Linux) or Windows system files—or remote files if the PHP configuration allows remote file inclusion via stream wrappers (e.g., php://input, data://, or http://). The vulnerability affects versions from an unspecified baseline through 1.2.8, suggesting a regression or long-standing flaw introduced early in the theme's development.

RemediationAI

Immediate Actions: (1) Update thembay Nika theme to the latest version >1.2.8 if available—verify on thembay's website or WordPress.org theme page; (2) If no patch is available, disable or remove the Nika theme and switch to an actively maintained alternative; (3) Implement Web Application Firewall (WAF) rules to detect and block LFI patterns (e.g., ../../../, file://, php://, data://) in request parameters. Code-Level Mitigations (if source is available): (a) Sanitize and validate all user inputs used in file inclusion statements using whitelist approaches (e.g., allowlist of permitted files or directories); (b) Use basename() or realpath() to prevent directory traversal; (c) Disable dangerous PHP settings like allow_url_include and allow_url_fopen if not needed; (d) Implement strict Content Security Policy (CSP) headers to limit resource loading. Workarounds: Restrict file permissions on the web server to limit exposure of sensitive files, and monitor access logs for suspicious file inclusion patterns.