What is the CVSS score of CVE-2025-53440?

CVE-2025-53440 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Confidant WordPress Theme are affected by CVE-2025-53440?

Axiomthemes Confidant WordPress theme (versions 1.4 and earlier) contains a local file inclusion vulnerability exposing organizations to unauthorized access to sensitive files and potential server…

How to fix or mitigate CVE-2025-53440?

Within 24 hours: Audit all WordPress installations to identify use of Axiomthemes Confidant theme versions ≤1.4; document count and data sensitivity of affected properties. Within 7 days: Contact Axiomthemes for patch availability timeline; evaluate operational feasibility of theme replacement or disabling; implement web application firewall (WAF) rules to block file inclusion patterns (directory traversal, PHP stream wrappers). Within 30 days: Deploy mitigation-either apply vendor patch upon release (subscribe to Axiomthemes security advisories) or migrate to alternative theme with equivalent functionality.

Confidant WordPress Theme CVE-2025-53440

EUVD-2025-210036 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 Patchstack

GHSA-g258-5m36-gv56

LFI Information Disclosure PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 11:52 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion.

This issue affects Confidant: from n/a through 1.4.

AnalysisAI

Local File Inclusion in Axiomthemes Confidant WordPress theme (versions up to and including 1.4) allows remote unauthenticated attackers to include arbitrary local PHP files on the server, potentially leading to sensitive information disclosure and code execution. The vulnerability is reported by Patchstack with a CVSS 8.1 (High) rating; no public exploit identified at time of analysis and the CVE is not present in CISA KEV. The high attack complexity (AC:H) suggests exploitation requires specific conditions to be met, despite the network-reachable, no-auth attack surface.

Technical ContextAI

Confidant is a commercial WordPress theme distributed by Axiomthemes. The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement), the canonical PHP file-inclusion weakness in which user-controlled input flows into include/require/include_once/require_once without proper sanitization or allowlisting. Although CWE-98 is the parent class for both Remote File Inclusion (RFI) and Local File Inclusion (LFI), the description explicitly limits the impact to LFI, meaning attacker-controlled values can reference files already present on the server (e.g., wp-config.php, /etc/passwd, session files, log files) rather than fetching remote PHP from an external URL. WordPress themes typically expose vulnerable include sinks through AJAX handlers, template-loader parameters, or page-builder shortcode handlers reachable via wp-admin/admin-ajax.php or the front-end. CPE coverage is cpe:2.3:a:axiomthemes:confidant:*:*:*:*:*:*:*:*, indicating all released branches up to 1.4 are in scope.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory documents the vulnerability through 1.4 but does not cite a fixed release version, so administrators should monitor the Axiomthemes ThemeForest/Envato changelog for a version higher than 1.4 and upgrade as soon as one is published. In the interim, deploy a virtual patch via Patchstack mPanel or a WAF rule (Wordfence, NinjaFirewall, ModSecurity) that blocks include/file/page/template parameters containing path traversal sequences (../), null bytes, php:// wrappers, or absolute paths to sensitive files such as wp-config.php; the trade-off is potential false positives against legitimate template-loader requests, so test in detection mode first. As a stricter compensating control, disable the Confidant theme and switch to a different theme until a fix is available, harden PHP with open_basedir restrictions scoped to the WordPress document root (this will break plugins that legitimately read outside the webroot), and set allow_url_include=Off and disable_functions for include-related wrappers to prevent escalation from LFI to RFI/RCE. Restrict outbound network access from the PHP worker to make log-poisoning and credential-exfiltration follow-ons harder.