What is the CVSS score of CVE-2025-53436?

CVE-2025-53436 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-53436?

BZOTheme Monki WordPress theme versions through 2.0.5 contains a local file inclusion vulnerability (CVSS 8.1) that enables unauthenticated attackers to execute arbitrary PHP code and access…

How to fix or mitigate CVE-2025-53436?

Within 24 hours: Identify all WordPress installations using BZOTheme Monki theme versions 2.0.5 or earlier via administrative dashboards or plugin scanners. Disable the theme immediately and switch to an alternative theme. Within 7 days: Remove the vulnerable theme files entirely from all affected servers. Conduct file integrity scans to detect unauthorized PHP files created via exploitation. Review access logs for suspicious file inclusion requests (look for PHP file paths in query parameters). Within 30 days: Update WordPress core, all active plugins, and themes to latest versions. Implement Web Application Firewall (WAF) rules to block local file inclusion patterns and monitor for file inclusion attacks.

PHP CVE-2025-53436

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

WordPress PHP LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 18, 2025 - 08:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Monki monki allows PHP Local File Inclusion.This issue affects Monki: from n/a through <= 2.0.5.

AnalysisAI

Local File Inclusion (LFI) in BZOTheme Monki WordPress theme versions through 2.0.5 allows unauthenticated remote attackers to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete system compromise. Despite the high 8.1 CVSS score, real-world exploitation probability remains low (EPSS 0.17%, 38th percentile) with no confirmed active exploitation or public exploit code identified at time of analysis. The vulnerability stems from improper filename validation in PHP include/require statements, classified as CWE-98.

Technical ContextAI

This vulnerability exploits improper validation of user-supplied input used in PHP include() or require() statements within the Monki WordPress theme. CWE-98 (PHP Remote File Inclusion) typically occurs when applications dynamically construct file paths without adequate sanitization, allowing attackers to manipulate parameters to include local files (LFI) or potentially remote files if allow_url_include is enabled. In WordPress themes, this commonly manifests in template loading mechanisms, AJAX handlers, or dynamic script includes where user input influences the file path. The vulnerability affects the Monki theme published by BZOTheme, a WordPress theme product, through version 2.0.5. The network-based attack vector (AV:N) indicates exploitation occurs over HTTP/HTTPS requests to the WordPress installation, while high attack complexity (AC:H) suggests exploitation requires specific conditions such as particular theme configurations, enabled features, or precise parameter manipulation.

Affected ProductsAI

BZOTheme Monki WordPress theme versions from an unspecified initial release through version 2.0.5 are confirmed vulnerable to this Local File Inclusion flaw. The vulnerability affects WordPress installations where the Monki theme is active, regardless of whether it is currently the displayed theme, as vulnerable code may remain accessible through direct requests. Patchstack vulnerability database confirms impact through version 2.0.4 with patches indicated in subsequent releases. Complete vendor advisory and affected version details are available at https://patchstack.com/database/Wordpress/Theme/monki/vulnerability/wordpress-monki-theme-2-0-4-local-file-inclusion-vulnerability.

RemediationAI

Immediately upgrade the Monki WordPress theme to version 2.0.6 or later, which addresses the improper filename validation in PHP include/require statements. The vendor-released patch is available through the WordPress theme update mechanism or directly from BZOTheme. For installations where immediate patching is not feasible, implement temporary mitigations including disabling the Monki theme if not actively required, restricting access to theme files through web application firewall rules targeting suspicious path traversal patterns (../, absolute paths, null bytes), and reviewing web server logs for exploitation attempts showing unusual file parameter values. Ensure PHP configuration has allow_url_include disabled to prevent escalation to Remote File Inclusion. After patching, conduct security review of WordPress file permissions and verify wp-config.php contains no exposed credentials. Complete technical details and patch confirmation available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/monki/vulnerability/wordpress-monki-theme-2-0-4-local-file-inclusion-vulnerability.