Houzez Theme Functionality CVE-2025-62054

Requires an authenticated low-privileged account on a WordPress site running Houzez Theme - Functionality ≤ 4.1.8 (PR:L), reaching a code path that passes attacker-influenced input into a PHP include/require statement (CWE-98). The high attack complexity (AC:H) and the RFI classification indicate a key limiting factor: true remote file inclusion typically requires PHP's allow_url_include/allow_url_fopen to be enabled, which is disabled by default in modern PHP, so most default deployments are limited to local file inclusion / information disclosure rather than remote code execution. Limiting factors: valid authentication is mandatory, no exploit is public, and full RCE impact likely depends on non-default PHP configuration.

This is a moderate-priority issue whose raw CVSS of 7.5 overstates practical urgency. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable but high-complexity flaw requiring low-privilege authentication, with full confidentiality/integrity/availability impact on the WordPress host. CWE-98 (PHP Remote File Inclusion) combined with AC:H strongly implies non-default preconditions - classic RFI depends on PHP's allow_url_include being enabled, which is Off by default in modern PHP, so true remote inclusion is often downgraded to local file inclusion in practice (consistent with the Patchstack/NVD 'LFI' and 'Information Disclosure' tagging). The exploitation signals are low: EPSS is 0.42% (35th percentile), the vulnerability is NOT in CISA KEV, and no public exploit was identified in the provided data. These weak exploitation signals align with the high attack complexity and authentication requirement. Note the internal tension worth verifying with the vendor: CWE-98 names Remote File Inclusion, while the Patchstack advisory title and tags describe Local File Inclusion/Information Disclosure - the realistic impact ceiling (RCE vs. file read) hinges on whether remote URL inclusion is actually reachable.

A low-privileged authenticated WordPress user (e.g., a registered account with contributor-level access on a site running the Houzez Theme Functionality plugin ≤ 4.1.8) supplies a crafted filename to a vulnerable include/require code path. Depending on PHP configuration, this discloses sensitive local files or, if remote URL inclusion is permitted, executes attacker-controlled PHP. No public exploit code was identified at time of analysis, and the high attack complexity (AC:H) indicates non-trivial preconditions.