What is the CVSS score of CVE-2025-60199?

CVE-2025-60199 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of InHype WordPress Theme are affected by CVE-2025-60199?

CVE-2025-60199 affects InHype WordPress Theme versions up to 1.5.2, enabling unauthenticated remote attackers to read arbitrary server files and potentially execute PHP code through local file…

How to fix or mitigate CVE-2025-60199?

Within 24 hours: Identify all WordPress installations using InHype Theme versions ≤1.5.2 via admin panel or database query; disable the theme immediately by switching to an alternative theme. Within 7 days: Remove InHype Theme files entirely from affected servers; monitor WordPress activity logs for suspicious file access patterns during the interim period. Within 30 days: If InHype Theme 1.5.3+ or patch release becomes available, evaluate and apply; otherwise, select and deploy a maintained, actively supported WordPress theme alternative.

InHype WordPress Theme CVE-2025-60199

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

WordPress LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.2 (HIGH) 8.1 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.2

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx InHype - Blog & Magazine WordPress Theme inhype allows PHP Local File Inclusion.This issue affects InHype - Blog & Magazine WordPress Theme: from n/a through <= 1.5.2.

AnalysisAI

Local file inclusion in InHype WordPress Theme versions up to 1.5.2 allows remote attackers to read arbitrary server files and potentially execute PHP code without authentication. Despite a high CVSS score of 8.1, the vulnerability has a low EPSS score (0.08%, 23rd percentile) and requires high attack complexity (AC:H), suggesting exploitation requires specific conditions or configuration knowledge. No active exploitation confirmed via CISA KEV, but Patchstack audit team has documented the vulnerability, increasing likelihood of public awareness and attempted exploitation.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a classic web application security flaw in PHP applications. The description indicates PHP Local File Inclusion (LFI), despite being titled as Remote File Inclusion - these are related but distinct: LFI allows reading local server files, while RFI permits execution of remote code. In WordPress themes, this typically occurs when user-controllable input (GET/POST parameters, HTTP headers, or cookies) is passed unsanitized into PHP include(), require(), include_once(), or require_once() functions. The theme likely accepts file path input for template loading or dynamic content inclusion without proper validation, allowing path traversal attacks using sequences like '../../../' to access files outside intended directories. Common targets include /etc/passwd for reconnaissance, WordPress configuration files (wp-config.php) containing database credentials, or PHP files containing sensitive code. If combined with file upload capabilities or log poisoning, LFI can escalate to remote code execution by including attacker-controlled PHP code.

Affected ProductsAI

WordPress InHype - Blog & Magazine Theme versions from earliest available through 1.5.2 inclusive, developed by dedalx. The vulnerability affects all installations running version 1.5.2 or earlier. Specific CPE data not provided in available sources. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/inhype/vulnerability/wordpress-inhype-blog-magazine-wordpress-theme-theme-1-5-2-local-file-inclusion-vulnerability.

RemediationAI

Upgrade InHype WordPress Theme to version 1.5.3 or later if available - version number inferred from affected range '<= 1.5.2' but not independently confirmed through vendor release notes. Check theme developer dedalx for latest version through ThemeForest or official distribution channel. If immediate upgrade is not possible, implement compensating controls: disable the InHype theme and switch to a maintained alternative WordPress theme until patched version is confirmed; restrict WordPress admin access to trusted IP addresses only; enable Web Application Firewall rules to block requests containing path traversal sequences (../, ..\ , %2e%2e%2f) in URL parameters and POST data; monitor server logs for suspicious file access patterns targeting configuration files; ensure WordPress wp-config.php has restrictive file permissions (0600 or 0640) to limit damage from successful LFI. Note that disabling the theme eliminates site functionality and requires content migration; WAF rules may cause false positives with legitimate plugins using file operations. Consult Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/inhype/vulnerability/wordpress-inhype-blog-magazine-wordpress-theme-theme-1-5-2-local-file-inclusion-vulnerability for additional vendor guidance.