EUVD-2025-209403
GHSA-rfxf-xpj4-mc2x
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CactusThemes VideoPro allows PHP Local File Inclusion.This issue affects VideoPro: from n/a through 2.3.8.1.
AnalysisAI
Local file inclusion in CactusThemes VideoPro WordPress theme through version 2.3.8.1 allows unauthenticated remote attackers to read arbitrary files on the server via improper filename control in PHP include/require statements. Exploitation requires high attack complexity but no user interaction. EPSS score indicates low observed exploitation activity; no public exploit identified at time of analysis.
Technical ContextAI
PHP remote file inclusion vulnerability (CWE-98) stemming from insufficient validation of user-supplied input passed to include/require statements. Despite CVE classification as RFI, tags and CVSS context indicate LFI behavior, enabling arbitrary file reads through path traversal. Attack vector network-based, complexity high (AC:H), suggesting conditional exploitation dependent on configuration or race conditions.
RemediationAI
No vendor-released patch identified at time of analysis. Immediately deactivate VideoPro theme and migrate to actively maintained alternative. Contact CactusThemes for patched version availability. Implement web application firewall rules to block path traversal attempts targeting theme directories. Restrict PHP file access permissions to minimum required. Monitor server logs for suspicious file inclusion patterns in theme-related requests. Advisory details: https://patchstack.com/database/wordpress/theme/videopro/vulnerability/wordpress-videopro-theme-2-3-8-1-local-file-inclusion-vulnerability. Do not re-enable theme until confirmed patched version released and applied.
Share
External POC / Exploit Code
Leaving vuln.today