Aromatica CVE-2025-58948

The Aromatica theme must be active on the target WordPress site. The vulnerable include/require function must accept user-supplied input without proper sanitization, likely via HTTP request parameters. No authentication is required (CVSS PR:N). Exploitation is limited by high attack complexity, requiring precise path traversal sequences or knowledge of file system layout. Success also depends on file permissions of the web server process and PHP settings (e.g., allow_url_include for certain techniques).

CVSS score of 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates high potential impact but also high attack complexity, meaning successful exploitation requires sophisticated request crafting and is not trivial. The EPSS score of 0.08% (23rd percentile) suggests very low real-world exploitation probability. No active exploitation (CISA KEV) or public proof-of-concept code has been reported. Overall, while the technical impact is severe if chained with other techniques, the immediate risk is moderate due to high complexity and lack of active exploitation.

An unauthenticated attacker crafts an HTTP request to a WordPress site using the Aromatica theme, manipulating a parameter (e.g., a file path) to traverse directories and include sensitive files such as /etc/passwd or WordPress configuration files. If the server processes the malicious input, file contents are disclosed. Through log poisoning or use of PHP wrappers, the attacker could escalate the LFI to remote code execution under specific server configurations.