What is the CVSS score of CVE-2025-53434?

CVE-2025-53434 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of ChildHope Theme are affected by CVE-2025-53434?

The ChildHope WordPress theme from AncoraThemes, versions up to and including 1.1.8, has a high-severity flaw that could allow an unauthenticated attacker to read sensitive server files on sites…

How to fix or mitigate CVE-2025-53434?

Within 24 hours, inventory all WordPress installations for the AncoraThemes ChildHope theme and determine whether any version up to and including 1.1.8 is installed and active, prioritizing internet-exposed sites; deactivate and remove the theme where it is not business-critical, and for sites that must retain it, apply WAF rules to block local file inclusion and PHP wrapper/traversal patterns, restrict PHP file permissions, disable allow_url_include, and enable focused logging for include/require attempts. Within 7 days, replace ChildHope with a maintained theme or isolate affected sites behind strict access controls, review PHP open_basedir and server configuration to prevent wrapper/log-poisoning abuse, and conduct a compromise assessment for unauthorized file reads or webshells. Within 30 days, because no vendor-released patch identified at time of analysis, monitor the vendor for a fixed release and apply it immediately once available, or permanently decommission the vulnerable theme; verify all instances are removed or on a non-vulnerable version, and update vulnerability management and incident response procedures.

ChildHope Theme CVE-2025-53434

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

PHP WordPress Information Disclosure LFI Wordpress Theme

8.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Unauthenticated network LFI (AV:N/PR:N) but AC:H for a valid includable path; C:H for file disclosure, I:L/A:L since code-execution/tampering is possible only via non-guaranteed chaining, not the base flaw.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 25, 2026 - 23:46 vuln.today

CVE Published

Dec 18, 2025 - 08:15 cve.org

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes ChildHope childhope allows PHP Local File Inclusion.This issue affects ChildHope: from n/a through <= 1.1.8.

AnalysisAI

Local file inclusion in the AncoraThemes ChildHope WordPress theme (versions up to and including 1.1.8) lets an unauthenticated, remote attacker influence a PHP include/require statement and read arbitrary files on the underlying web server. The assessed vector is network-reachable with no authentication or user interaction (AV:N/PR:N/UI:N), but attack complexity is High (AC:H) because exploitation requires the attacker to supply a valid includable local path - or a workable wrapper/log-poisoning gadget - rather than issuing a single trivial request; escalation from disclosure to code execution further depends on server configuration. No public exploit code and no confirmed active exploitation were identified at time of analysis, and EPSS is low (0.50%, ~40th percentile), so real-world risk is driven primarily by whether the vulnerable theme is installed and active on an internet-exposed site. Note the independent assessment rates impact as C:H/I:L/A:L, slightly lower on integrity and availability than the vendor-published CVSS score of 8.1.

Technical ContextAI

The weakness class is CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program - commonly labeled PHP Remote File Inclusion, though in this case the practical effect is Local File Inclusion (LFI). PHP's include/require constructs resolve a filesystem path (or URL/wrapper) at runtime; when the theme passes attacker-influenceable input into that path without a strict allow-list, the attacker can steer the interpreter toward files outside the intended template directory. While RFI requires allow_url_include (disabled by default in modern PHP), LFI typically does not, and can disclose configuration files, wp-config.php, /etc/passwd, or credentials, and in some configurations can be chained into code execution via PHP stream wrappers (php://filter, php://input with allow_url_include), log poisoning, or upload/ session files that an attacker can influence. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable bug where the confidentiality impact is high (arbitrary file read) but the successful path is non-trivial (AC:H), consistent with the independent assessment of AV:N/AC:H/PR:N/UI:N with C:H but only I:L/A:L. The affected technology stack is a WordPress theme - third-party PHP code loaded and executed inside the CMS - so the effective attack surface is the publicly reachable WordPress front end of any site running the ChildHope theme.

Affected ProductsAI

The AncoraThemes ChildHope WordPress theme is affected in all versions up to and including 1.1.8 (the advisory states "<= 1.1.8"); no explicit CPE identifier was provided in the source data. Any WordPress installation with the ChildHope theme installed and active is potentially vulnerable, particularly internet-facing sites. The authoritative advisory is the Patchstack entry referenced by NVD at https://patchstack.com/database/Wordpress/Theme/childhope/vulnerability/wordpress-childhope-theme-1-1-8-local-file-inclusion-vulnerability?_s_id=cve, credited to reporter audit@patchstack.com, tagged PHP, Information Disclosure, and LFI. Sites running child themes that inherit the vulnerable parent theme code should be treated as affected as well.

RemediationAI

No vendor-released patch version (e.g., 1.1.9 or later) is identified in the provided data, so the safest immediate action is to deactivate and remove the ChildHope theme from any production WordPress site and replace it with a maintained theme - trade-off: loss of the specific ChildHope look/features, which must be reimplemented or accepted. If the theme must remain, compensating controls include placing a WAF/reverse proxy rule in front of WordPress to reject requests containing path-traversal sequences (../, ..%2f), PHP stream wrappers (php://, data://, file://), or absolute path fragments in theme-related parameters; restricting file reads via open_basedir and disabling allow_url_include and allow_url_fopen in php.ini (trade-off: may break legitimate remote-fetch or wrapper-dependent functionality), running PHP under a least-privilege pool user with no read access to wp-config.php or other sensitive paths, and blocking direct access to theme PHP files that perform include/require operations. Continue to monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/childhope/vulnerability/wordpress-childhope-theme-1-1-8-local-file-inclusion-vulnerability?_s_id=cve) and the vendor's site for a fixed release, and review server and WordPress logs for anomalous include paths in the interim; because exploitation is unauthenticated and remote, front-end monitoring and virtual patching are the highest-value compensating measures until a patch ships.