Xcare Theme CVE-2025-59550

Exploitation requires a request that reaches an Xcare theme code path which passes attacker-controlled input into a PHP include/require statement; it affects only Xcare theme versions below 6.5. No authentication is required (PR:N), but the CVSS AC:H indicates meaningful limiting factors - the attacker must craft input that satisfies specific conditions (e.g., a valid-looking path or parameter format, or filter bypass) for the file inclusion to resolve, so exploitation is not point-and-click. The product must be a live WordPress site running the vulnerable Xcare theme; sites on 6.5 or later, or not using this theme, are unaffected.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) describes a network-reachable, unauthenticated flaw with full C:H/I:H/A:H impact, which drives the 8.1 'High' score - but the AC:H (high attack complexity) is the critical moderating signal, indicating exploitation is not trivially reliable and likely requires specific conditions or crafted input to succeed. Supporting signals point to lower real-world urgency: EPSS is only 0.52% (42nd percentile), there is NO CISA KEV listing, and NO public exploit code was identified - so this is theoretically serious but not currently being exploited at scale. Note a label tension: CWE-98 is titled 'PHP Remote File Inclusion' and impacts are rated I:H/A:H, yet the description explicitly says 'PHP Local File Inclusion' and the tags emphasize 'Information Disclosure' - LFI primarily yields confidentiality impact, with integrity/availability realistic only via escalation (e.g., log poisoning to code execution); verify the actual impact depth with the vendor/Patchstack advisory. Combined with a niche affected product, this warrants prompt patching but not emergency response.

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable Xcare theme endpoint, supplying input that is passed into a PHP include/require statement to load an arbitrary local file. Because attack complexity is high, the attacker must satisfy specific conditions (e.g., a particular parameter value or path format) before the inclusion resolves, after which they can read sensitive files such as wp-config.php or potentially escalate to code execution. No public proof-of-concept exploit was identified at the time of analysis.