Aromatica
CVE-2025-58948
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
LFI can enable code execution via log poisoning or PHP wrappers, so integrity/availability impact set to High; high complexity due to path crafting.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Aromatica aromatica allows PHP Local File Inclusion.This issue affects Aromatica: from n/a through <= 1.8.
AnalysisAI
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Technical ContextAI
The vulnerability arises from improper control of filenames for include/require statements in PHP (CWE-98). The Aromatica theme, as indicated by CPE data (cpe:2.3:a:axiomthemes:aromatica:*:*:*:*:*:wordpress:*:*), fails to adequately sanitize user-supplied input used in file inclusion functions, allowing path traversal and local file inclusion. Attackers can manipulate parameters to include any local file readable by the web server process, exploiting common PHP features like include or require without proper validation.
RemediationAI
Upgrade Aromatica to version 1.9 or later, which fixes this vulnerability. The Patchstack advisory does not specify an exact fixed version, but versions beyond 1.8 are assumed safe. If immediate upgrading is not possible, disable the Aromatica theme and switch to a default WordPress theme as a temporary measure. As a general mitigation against LFI, restrict file system permissions for the web server user, disable allow_url_fopen and allow_url_include in PHP configuration if not required, and consider using a web application firewall to filter path traversal attempts. Note that these workarounds may alter legitimate behavior or require careful testing.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-98 – PHP Remote File Inclusion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today