What is the CVSS score of CVE-2025-62067?

CVE-2025-62067 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Savory WordPress Theme are affected by CVE-2025-62067?

The Elated-Themes Savory WordPress theme (through version 2.5) contains a remote file inclusion vulnerability (CVE-2025-62067) that could allow attackers to execute arbitrary PHP code on affected…

How to fix or mitigate CVE-2025-62067?

Within 24 hours: Inventory all WordPress installations using Elated-Themes Savory theme and document current versions. Within 7 days: Disable or remove the Savory theme from all affected sites; switch to an alternative theme or contact vendor for availability of patched version 2.6 or later. Within 30 days: Implement application-level controls restricting file inclusion functions and review web application firewall rules to block suspicious file inclusion patterns; document theme replacement completion.

Savory WordPress Theme CVE-2025-62067

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:22 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Savory savory.This issue affects Savory: from n/a through <= 2.5.

AnalysisAI

Remote file inclusion in Elated-Themes Savory WordPress theme through version 2.5 allows network-based attackers to execute arbitrary PHP code by manipulating file inclusion statements. Despite a CVSS score of 8.1, real-world exploitation risk appears low with an EPSS probability of 0.03% (8th percentile) and no evidence of active exploitation or public proof-of-concept code. The vulnerability classification as CWE-98 combined with conflicting tags (both RFI and LFI referenced) requires clarification - the attack complexity rating of High (AC:H) suggests non-trivial prerequisites for successful exploitation despite the network attack vector.

Technical ContextAI

This vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), a class of injection flaws where user-controlled input influences which files the application loads at runtime. While officially classified as PHP Remote File Inclusion (RFI), the vulnerability tags also reference Local File Inclusion (LFI), indicating potential confusion in classification. True RFI allows attackers to load malicious PHP code from external URLs when allow_url_include is enabled in php.ini, while LFI restricts inclusion to files already on the server. The Savory theme is a WordPress premium theme framework developed by Elated-Themes, suggesting the flaw exists in theme-specific file handling logic rather than core WordPress. The network attack vector combined with high attack complexity suggests the vulnerability requires specific configuration states or request conditions to trigger successfully.

Affected ProductsAI

The vulnerability affects Elated-Themes Savory WordPress theme versions from an unspecified starting point through version 2.5 and earlier. No CPE identifier is available in the provided data. According to the Patchstack database reference at https://patchstack.com/database/Wordpress/Theme/savory/vulnerability/wordpress-savory-theme-2-5-local-file-inclusion-vulnerability?_s_id=cve, this is a premium WordPress theme product requiring separate vendor engagement for advisories. The version range notation 'from n/a through <= 2.5' indicates the initial affected version is undocumented, requiring users of any Savory theme version 2.5 or older to assume vulnerability.

RemediationAI

WordPress administrators running Savory theme version 2.5 or earlier should immediately contact Elated-Themes through their support channels or ThemeForest marketplace to obtain version 2.6 or later if available, or request specific remediation guidance. The Patchstack reference at https://patchstack.com/database/Wordpress/Theme/savory/vulnerability/wordpress-savory-theme-2-5-local-file-inclusion-vulnerability?_s_id=cve may contain version-specific patching instructions for registered users. As an immediate compensating control, verify php.ini has allow_url_include set to Off (default since PHP 5.2.0) to prevent remote file inclusion exploitation vectors, though this does not address potential local file inclusion risks. Consider temporarily switching to a different WordPress theme until vendor patch confirmation, accepting the trade-off of visual design changes versus continued exposure. Implement Web Application Firewall rules to detect and block requests containing URL-encoded path traversal sequences (../, %2e%2e%2f) and PHP wrapper protocols (php://, data://, expect://) in parameters passed to theme files, noting this may cause false positives if the theme legitimately processes file paths in customization features.