What is the CVSS score of CVE-2025-62055?

CVE-2025-62055 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Academist Theme are affected by CVE-2025-62055?

The WordPress Academist theme versions below 1.3 contain a local file inclusion vulnerability (CVE-2025-62055) that could allow attackers to execute arbitrary code and compromise WordPress sites…

How to fix or mitigate CVE-2025-62055?

Within 24 hours: Identify all WordPress installations using Academist theme and document current version numbers across your environment. Within 7 days: Upgrade Academist theme to version 1.3 or later on all affected sites; if upgrade is not possible, immediately deactivate and remove the theme pending patch release. Within 30 days: Conduct security audit of any sites that ran vulnerable Academist versions, checking file access logs and database for unauthorized activity or code injection.

Academist Theme CVE-2025-62055

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:24 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist academist.This issue affects Academist: from n/a through < 1.3.

AnalysisAI

Local file inclusion in WordPress Academist theme versions prior to 1.3 enables remote attackers to include arbitrary PHP files from the server filesystem, leading to potential information disclosure, code execution, and full site compromise. The vulnerability stems from improper filename validation in PHP include/require statements. Despite a CVSS score of 8.1, the EPSS probability is only 0.05% (16th percentile), suggesting attackers have not widely adopted this technique, though the attack complexity is rated high. No confirmed active exploitation or public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability is a PHP Remote File Inclusion (RFI) classified as CWE-98, affecting the Academist WordPress theme by Elated-Themes. The flaw occurs when user-controlled input is passed to PHP include() or require() functions without proper sanitization, allowing attackers to manipulate file paths. While tagged as RFI and categorized under CWE-98, the Patchstack reference and LFI tag suggest this is actually a Local File Inclusion vulnerability, where attackers can include existing files on the server rather than remote URLs. The discrepancy between the CWE-98 classification (which typically covers RFI) and the LFI tag indicates the vulnerability likely allows traversal to local files but may have been classified under the broader CWE category. WordPress themes commonly expose this vulnerability through improperly validated template file parameters or AJAX handlers that accept file paths.

Affected ProductsAI

WordPress Academist theme by Elated-Themes, all versions prior to version 1.3. The vulnerability report from Patchstack (audit@patchstack.com) specifically identifies the theme slug as 'academist' in WordPress installations. No CPE string was provided in the available data, limiting precise asset inventory queries. Organizations can identify affected installations by checking their WordPress theme directory for the Academist theme and verifying the version number is below 1.3. The vendor advisory is available at https://patchstack.com/database/Wordpress/Theme/academist/vulnerability/wordpress-academist-theme-1-3-local-file-inclusion-vulnerability.

RemediationAI

Update the Academist WordPress theme to version 1.3 or later, which addresses the file inclusion vulnerability according to Patchstack's database entry (https://patchstack.com/database/Wordpress/Theme/academist/vulnerability/wordpress-academist-theme-1-3-local-file-inclusion-vulnerability). WordPress administrators should navigate to Appearance > Themes in the WordPress admin panel and apply available updates. If immediate patching is not feasible, implement these compensating controls with noted trade-offs: disable the Academist theme and switch to a core WordPress theme (Twenty Twenty-Four or similar) until patching is complete, which may affect site appearance and require temporary redesign; configure web application firewall rules to block requests containing directory traversal patterns (../, .\, %2e%2e) to theme files, though this may cause false positives with legitimate file upload functionality; restrict PHP file execution in the wp-content/themes/academist/ directory via .htaccess rules (Apache) or location blocks (nginx), which prevents exploitation but may break intended theme functionality if the theme legitimately executes PHP in subdirectories. Verify remediation by testing that user-supplied parameters cannot influence file paths in theme includes.