How to fix CVE-2025-50003?

Within 24 hours: Identify all systems running Amuli theme ≤2.3.0 and assess internet exposure; disable the theme or restrict access via WAF/network controls if possible. Within 7 days: Contact axiomthemes for patch availability or interim fixes; implement compensating controls (WAF rules blocking suspicious file inclusion patterns, web server module restrictions). Within 30 days: Apply vendor patch immediately upon release, or migrate to alternative verified theme; conduct full security audit of affected systems for signs of exploitation.

Is PHP affected by CVE-2025-50003?

A critical remote file inclusion vulnerability in Amuli theme (CVE-2025-50003) affects PHP-based websites running version 2.3.0 or earlier, allowing attackers to execute arbitrary code and compromise site functionality, data, and customer trust.

CVE-2025-50003

CRITICAL

2026-01-22 [email protected]

9.8

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:15 nvd

CRITICAL 9.8

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Amuli amuli allows PHP Local File Inclusion.This issue affects Amuli: from n/a through <= 2.3.0.

Analysis

A WordPress plugin has a PHP Remote File Inclusion vulnerability allowing attackers to include malicious remote PHP files for unauthenticated code execution.

Technical Context

CWE-98 vulnerability in a WordPress plugin allows remote PHP file inclusion through user-controlled parameters.

Affected Products

['Affected WordPress plugin']

Remediation

Update or remove the plugin. Disable allow_url_include in PHP.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.2

CVSS: +49

POC: 0

CVE-2025-50003 vulnerability details – vuln.today

Back

CVE-2025-50003

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-50003

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code