CVE-2025-53436
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Monki monki allows PHP Local File Inclusion.This issue affects Monki: from n/a through <= 2.0.5.
Analysis
Local File Inclusion (LFI) in BZOTheme Monki WordPress theme versions through 2.0.5 allows unauthenticated remote attackers to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete system compromise. Despite the high 8.1 CVSS score, real-world exploitation probability remains low (EPSS 0.17%, 38th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis. The vulnerability stems from improper filename validation in PHP include/require statements, classified as CWE-98.
Technical Context
This vulnerability exploits improper validation of user-supplied input used in PHP include() or require() statements within the Monki WordPress theme. CWE-98 (PHP Remote File Inclusion) typically occurs when applications dynamically construct file paths without adequate sanitization, allowing attackers to manipulate parameters to include local files (LFI) or potentially remote files if allow_url_include is enabled. In WordPress themes, this commonly manifests in template loading mechanisms, AJAX handlers, or dynamic script includes where user input influences the file path. The vulnerability affects the Monki theme published by BZOTheme, a WordPress theme product, through version 2.0.5. The network-based attack vector (AV:N) indicates exploitation occurs over HTTP/HTTPS requests to the WordPress installation, while high attack complexity (AC:H) suggests exploitation requires specific conditions such as particular theme configurations, enabled features, or precise parameter manipulation.
Affected Products
BZOTheme Monki WordPress theme versions from an unspecified initial release through version 2.0.5 are confirmed vulnerable to this Local File Inclusion flaw. The vulnerability affects WordPress installations where the Monki theme is active, regardless of whether it is currently the displayed theme, as vulnerable code may remain accessible through direct requests. Patchstack vulnerability database confirms impact through version 2.0.4 with patches indicated in subsequent releases. Complete vendor advisory and affected version details are available at https://patchstack.com/database/Wordpress/Theme/monki/vulnerability/wordpress-monki-theme-2-0-4-local-file-inclusion-vulnerability.
Remediation
Immediately upgrade the Monki WordPress theme to version 2.0.6 or later, which addresses the improper filename validation in PHP include/require statements. The vendor-released patch is available through the WordPress theme update mechanism or directly from BZOTheme. For installations where immediate patching is not feasible, implement temporary mitigations including disabling the Monki theme if not actively required, restricting access to theme files through web application firewall rules targeting suspicious path traversal patterns (../, absolute paths, null bytes), and reviewing web server logs for exploitation attempts showing unusual file parameter values. Ensure PHP configuration has allow_url_include disabled to prevent escalation to Remote File Inclusion. After patching, conduct security review of WordPress file permissions and verify wp-config.php contains no exposed credentials. Complete technical details and patch confirmation available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/monki/vulnerability/wordpress-monki-theme-2-0-4-local-file-inclusion-vulnerability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today