What is the CVSS score of CVE-2025-53252?

CVE-2025-53252 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-53252?

CVE-2025-53252 is a Local File Inclusion vulnerability affecting Zegen WordPress theme versions up to 1.1.9 that allows authenticated low-privilege users to read arbitrary server files under specific…

How to fix or mitigate CVE-2025-53252?

Within 24 hours: Disable the Zegen WordPress theme on all affected installations and identify all sites using versions 1.1.9 and earlier. Within 7 days: Audit user access logs for any suspicious file read attempts from low-privilege accounts; replace Zegen with an actively maintained alternative theme. Within 30 days: Conduct post-incident review of user accounts and secrets (database credentials, API keys) exposed via WordPress configuration files; implement file access controls and Web Application Firewall rules to restrict file inclusion attempts.

PHP CVE-2025-53252

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:52 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 7.5 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Zegen zegen allows PHP Local File Inclusion.This issue affects Zegen: from n/a through <= 1.1.9.

AnalysisAI

Local File Inclusion vulnerability in Zegen WordPress theme versions up to 1.1.9 allows authenticated remote attackers with low privileges to read arbitrary files on the server. Exploitation requires high attack complexity (AC:H), suggesting specific configuration or timing conditions must be met. EPSS score of 0.22% (45th percentile) indicates low probability of widespread exploitation. No public exploit code or active exploitation confirmed at time of analysis.