What is the CVSS score of CVE-2025-60071?

CVE-2025-60071 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Riode WordPress Theme are affected by CVE-2025-60071?

The Riode WordPress theme versions 1.6.23 and earlier contain a local file inclusion vulnerability that allows unauthenticated remote attackers to read arbitrary files from affected web servers,…

How to fix or mitigate CVE-2025-60071?

Within 24 hours: Identify all WordPress installations using Riode theme version ≤1.6.23 and document affected systems. Within 7 days: Implement Web Application Firewall (WAF) rules to block file inclusion patterns targeting the vulnerable theme components, and apply input validation controls at the application level. Within 30 days: Contact theme vendor for updated release timeline; if no patch is released, evaluate alternative themes or consider deactivating the affected theme pending vendor remediation.

Riode WordPress Theme CVE-2025-60071

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:17 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 18, 2025 - 08:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through <= 1.6.23.

AnalysisAI

Local file inclusion in Riode WordPress theme versions ≤1.6.23 allows remote unauthenticated attackers to read arbitrary files from the web server filesystem, potentially exposing configuration files, credentials, and source code. The vulnerability stems from improper filename control in PHP include/require statements. Despite the high CVSS score of 8.1, EPSS indicates only 0.06% exploitation probability (18th percentile), suggesting limited attacker interest. No active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability classified as CWE-98 (Improper Control of Filename for Include/Require Statement). The Riode theme, a WooCommerce-focused WordPress theme by don-themes, fails to properly sanitize user-controllable input before passing it to PHP include() or require() functions. While the CVE title references 'PHP Remote File Inclusion', the description and Patchstack classification confirm this as LFI. The distinction is critical: LFI allows reading local server files (configuration files, /etc/passwd, wp-config.php), while RFI would allow including remote malicious code. The vulnerability exists in the theme's PHP codebase where file path parameters are processed without adequate validation, typical in WordPress themes that dynamically load template files or process AJAX requests with file path parameters.

Affected ProductsAI

Riode Multi-Purpose WooCommerce Theme for WordPress, all versions from earliest release through version 1.6.23 inclusive. The theme is developed by don-themes and available through ThemeForest. Specific CPE identifier not provided in NVD data. Vulnerability confirmed by Patchstack Database entry (https://patchstack.com/database/Wordpress/Theme/riode/vulnerability/wordpress-riode-multi-purpose-woocommerce-theme-1-6-23-local-file-inclusion-vulnerability). Users of Riode theme on any WordPress installation should verify their installed version immediately.

RemediationAI

Upgrade Riode theme to version 1.6.24 or later if available from ThemeForest or the vendor's official distribution channel. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/riode/vulnerability/wordpress-riode-multi-purpose-woocommerce-theme-1-6-23-local-file-inclusion-vulnerability for vendor-specific remediation guidance and confirmed fix version. If upgrading is not immediately feasible, implement compensating controls: disable the Riode theme and switch to a secure alternative theme temporarily; restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules; enable Web Application Firewall (WAF) rules to block common LFI patterns in HTTP parameters (../, %2e%2e%2f, php://filter); monitor web server logs for suspicious file access attempts targeting sensitive files like wp-config.php or /etc/passwd. Note that WAF-based mitigation may cause false positives blocking legitimate theme functionality, requiring tuning. Virtual patching via WordPress security plugins (Wordfence, Sucuri) can provide immediate protection while planning theme upgrade or replacement.