Hygia CVE-2025-53453

No special conditions beyond an active Hygia theme installation. The high attack complexity (AC:H) suggests exploitation likely requires precise knowledge of the vulnerable parameter and careful crafting of the payload; it is not a “point-and-click” exploit. No authentication or user interaction is required, but the vulnerability is not trivially exploitable against all deployments without detailed reconnaissance.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-exploitable vulnerability with no authentication or user interaction but high attack complexity, which limits practical exploitability. EPSS probability of exploitation is only 0.08% (23rd percentile), reinforcing the low likelihood of real-world utilization. No entry in CISA's Known Exploited Vulnerabilities (KEV) catalog exists, and no public proof-of-concept code has been identified. These signals collectively suggest a issue that, while severe in potential impact, is not an immediate priority for most organizations. However, if the theme is in use, local file disclosure risks credential exposure and should not be ignored.

A remote attacker crafts a specially crafted HTTP request targeting a vulnerable theme endpoint that processes file inclusion, using path traversal sequences to include local server files such as wp-config.php. Successful exploitation could disclose database credentials and other sensitive information, potentially leading to full site compromise.