EduMall CVE-2025-59564

Exploitation targets improper control of a filename supplied to a PHP include/require statement in the EduMall theme on versions from the earliest release through any version below 4.4.5. Per CVSS PR:N, no authentication is indicated, but the AC:H rating signals meaningful limiting factors: successful inclusion likely depends on a specific parameter/endpoint and on the attacker being able to influence or reach an includable file path (and, for code execution rather than mere file read, the ability to plant PHP content such as via an upload or log-poisoning primitive). The exact vulnerable parameter, request path, and whether any non-default configuration is required are NOT disclosed in the provided description or the single Patchstack reference, so defenders should confirm the trigger conditions against the vendor advisory. Realistic risk is bounded by these unknown preconditions and the high attack complexity.

Signals are moderately consistent but point to a non-urgent priority. The NVD CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) scores 8.1 (High) and indicates a network-reachable, unauthenticated flaw, but the AC:H flag means successful exploitation depends on conditions outside the attacker's direct control, which materially lowers reliability. EPSS is low at 0.53% (43rd percentile), and there is no CISA KEV listing and no referenced public exploit code, so this is best characterized as 'no public exploit identified at time of analysis.' No SSVC decision record was supplied. A notable internal conflict: the CWE (CWE-98, PHP Remote File Inclusion) and the title say 'Remote File Inclusion,' yet the description explicitly states the realized impact is 'PHP Local File Inclusion' - these are distinct and the C:H/I:H/A:H impact rating assumes inclusion escalates to code execution, which is not spelled out in the description. Net: a genuinely serious class of bug in a commercial WordPress theme, but the combination of high attack complexity, low EPSS, absent KEV, and no known POC places it as a 'patch-in-normal-cycle' High rather than an emergency. The RFI-vs-LFI labeling discrepancy should be verified with the Patchstack advisory before assuming full RCE impact.

An unauthenticated remote attacker crafts an HTTP request to the EduMall theme that manipulates a filename passed to a PHP include/require statement, causing the server to include an attacker-influenced or local file. If the attacker can seed PHP content (e.g. via an uploaded file or poisoned log) that then gets included, this can escalate from arbitrary file disclosure (e.g. wp-config.php credentials) to remote code execution. No public exploit code is referenced, and the CVSS AC:H rating implies exploitation requires specific, non-trivial conditions to be met.