Medizin WordPress Theme CVE-2025-59555

Exploitation targets the Medizin theme's handling of a filename/path value that flows into a PHP include/require statement (CWE-98), affecting all versions up to but not including 1.9.7. Per CVSS PR:N/UI:N, no authentication or user interaction is required, and AV:N makes it network-reachable. The key LIMITING factor is AC:H: the description does not name the exact vulnerable parameter or endpoint, and successful inclusion likely depends on specific prerequisites (a reachable injection point, and for code execution a local file the attacker can influence, e.g., via log poisoning, or an enabled PHP wrapper). It also requires the Medizin theme to be installed and active on the target WordPress site. The exact feature/parameter should be confirmed from the Patchstack advisory.

This is a genuine but mid-tier priority. The CVSS 3.1 base score of 8.1 (High) is driven by a network attack vector (AV:N), no authentication (PR:N), and no user interaction (UI:N), combined with full CIA impact (C:H/I:H/A:H) - however, this is significantly tempered by high attack complexity (AC:H), which signals that exploitation depends on conditions outside the attacker's control rather than a trivial one-shot request. The supporting signals point AWAY from urgent, widespread exploitation: EPSS is low at 0.53% (43rd percentile), there is no CISA KEV listing, and no public exploit (POC) was identified in the provided data. No SSVC decision data was supplied. Note a classification tension: the CWE is CWE-98 ('PHP Remote File Inclusion') and the vendor string references RFI, but the description and Patchstack title both state 'PHP Local File Inclusion' - these are distinct (RFI pulls a remote attacker-hosted file; LFI includes a local server path), and the discrepancy should be verified against the Patchstack advisory, as it materially affects whether direct remote code execution is possible. Net: a real high-severity issue worth patching, but the low EPSS, absence of KEV/POC, and AC:H argue against treating it as an active, mass-exploitation emergency.

A remote, unauthenticated attacker crafts a request to a vulnerable endpoint in the ThemeMove Medizin theme that passes attacker-influenced input into a PHP include/require statement, causing the server to include a local file (e.g., sensitive configuration or a log file poisoned with PHP). Because AC:H applies, success depends on specific preconditions - such as a reachable parameter, log-poisoning primitives, or a particular wrapper being enabled - rather than a single trivial request. No public proof-of-concept was identified at the time of analysis, so weaponization effort would be required.