CVE-2025-63074
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.This issue affects The7: from n/a through < 12.8.1.1.
Analysis
Local File Inclusion in Dream-Theme's The7 WordPress theme (versions prior to 12.8.1.1) allows authenticated attackers with low privileges to read arbitrary server files through improper filename validation in PHP include statements. With a 0.17% EPSS score and no confirmed active exploitation, this represents a moderate risk primarily in shared hosting environments where authenticated users exist. The 7.5 CVSS score reflects high confidentiality and integrity impact, though exploitation requires high attack complexity and authenticated access.
Technical Context
This vulnerability stems from CWE-98, improper control of filename parameters in PHP include/require statements within the dt-the7 WordPress theme. The flaw allows manipulation of file paths passed to PHP inclusion functions, enabling Local File Inclusion (LFI) attacks. While classified as 'PHP Remote File Inclusion' in the vulnerability description, the tags and technical analysis confirm this is a Local File Inclusion issue. LFI vulnerabilities occur when applications dynamically construct file paths for inclusion without proper sanitization, allowing directory traversal sequences or absolute paths to access files outside intended directories. In WordPress theme contexts, this typically manifests in template loading mechanisms, AJAX handlers, or dynamic content inclusion features where user-controlled input influences file path construction.
Affected Products
The vulnerability affects Dream-Theme's The7 WordPress theme in all versions prior to 12.8.1.1. The7 is a popular multipurpose WordPress theme with extensive customization capabilities. The affected component is identified as dt-the7, and the vulnerability exists in the theme's PHP file inclusion mechanisms. Organizations running The7 theme versions below 12.8.1.1 should verify their installation version through WordPress admin dashboard under Appearance > Themes. The vulnerability was reported by Patchstack's audit team, and detailed vulnerability information is available in the Patchstack database at their WordPress theme security advisory portal.
Remediation
Immediately update The7 theme to version 12.8.1.1 or later, which addresses the improper filename validation in PHP include statements. WordPress administrators can update through the dashboard by navigating to Appearance > Themes and selecting update for The7 if available, or by downloading the patched version directly from ThemeForest or the official Dream-Theme distribution channel. As an interim mitigation for environments where immediate patching is not feasible, restrict authenticated user roles to trusted personnel only, review and limit subscriber and contributor account privileges, implement web application firewall rules to detect directory traversal patterns in requests to theme files, and monitor server logs for suspicious file access attempts. Organizations should audit existing user accounts for unauthorized or dormant credentials. Full vulnerability details and vendor advisory information are available at https://patchstack.com/database/Wordpress/Theme/dt-the7/vulnerability/wordpress-the7-theme-12-8-0-2-local-file-inclusion-vulnerability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today