What is the CVSS score of CVE-2025-63074?

CVE-2025-63074 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-63074?

The7 WordPress theme versions below 12.8.1.1 contain a local file inclusion vulnerability that allows authenticated users with low privileges to read arbitrary server files, potentially exposing…

How to fix or mitigate CVE-2025-63074?

Within 24 hours: Identify all WordPress installations using The7 theme and document current versions. Within 7 days: Upgrade The7 theme to version 12.8.1.1 or later on all affected sites; if upgrading is not immediately possible, restrict user registration and deactivate user accounts not essential to operations. Within 30 days: Conduct a file access audit on affected servers to identify any unauthorized file reads, and review access logs for suspicious file inclusion attempts.

PHP CVE-2025-63074

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-09 audit@patchstack.com

WordPress PHP LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 09, 2025 - 16:18 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through < 12.8.1.1.

AnalysisAI

Local File Inclusion in Dream-Theme's The7 WordPress theme (versions prior to 12.8.1.1) allows authenticated attackers with low privileges to read arbitrary server files through improper filename validation in PHP include statements. With a 0.17% EPSS score and no confirmed active exploitation, this represents a moderate risk primarily in shared hosting environments where authenticated users exist. The 7.5 CVSS score reflects high confidentiality and integrity impact, though exploitation requires high attack complexity and authenticated access.

Technical ContextAI

This vulnerability stems from CWE-98, improper control of filename parameters in PHP include/require statements within the dt-the7 WordPress theme. The flaw allows manipulation of file paths passed to PHP inclusion functions, enabling Local File Inclusion (LFI) attacks. While classified as 'PHP Remote File Inclusion' in the vulnerability description, the tags and technical analysis confirm this is a Local File Inclusion issue. LFI vulnerabilities occur when applications dynamically construct file paths for inclusion without proper sanitization, allowing directory traversal sequences or absolute paths to access files outside intended directories. In WordPress theme contexts, this typically manifests in template loading mechanisms, AJAX handlers, or dynamic content inclusion features where user-controlled input influences file path construction.

Affected ProductsAI

The vulnerability affects Dream-Theme's The7 WordPress theme in all versions prior to 12.8.1.1. The7 is a popular multipurpose WordPress theme with extensive customization capabilities. The affected component is identified as dt-the7, and the vulnerability exists in the theme's PHP file inclusion mechanisms. Organizations running The7 theme versions below 12.8.1.1 should verify their installation version through WordPress admin dashboard under Appearance > Themes. The vulnerability was reported by Patchstack's audit team, and detailed vulnerability information is available in the Patchstack database at their WordPress theme security advisory portal.

RemediationAI

Immediately update The7 theme to version 12.8.1.1 or later, which addresses the improper filename validation in PHP include statements. WordPress administrators can update through the dashboard by navigating to Appearance > Themes and selecting update for The7 if available, or by downloading the patched version directly from ThemeForest or the official Dream-Theme distribution channel. As an interim mitigation for environments where immediate patching is not feasible, restrict authenticated user roles to trusted personnel only, review and limit subscriber and contributor account privileges, implement web application firewall rules to detect directory traversal patterns in requests to theme files, and monitor server logs for suspicious file access attempts. Organizations should audit existing user accounts for unauthorized or dormant credentials. Full vulnerability details and vendor advisory information are available at https://patchstack.com/database/Wordpress/Theme/dt-the7/vulnerability/wordpress-the7-theme-12-8-0-2-local-file-inclusion-vulnerability.