The7 Elements CVE-2025-63076
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
DeliveryCraft request to vulnerable include parameter
-
ExploitTrigger local file inclusion in plugin
-
ExecutionRead sensitive files or include poisoned file
-
ImpactDisclose data or execute PHP code
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session at a low privilege level (CVSS PR:L) on a WordPress site running the The7 Elements (dt-the7-core) plugin version 2.7.11 or earlier, plus the ability to reach the specific plugin feature that builds an include/require path from attacker-influenced input (the exact parameter is not named in the available data). Limiting factors: authentication is required (not anonymous), attack complexity is rated high (AC:H), implying additional non-default conditions or precise setup are needed to reliably control the included path, and escalation beyond file disclosure to code execution would further depend on the attacker being able to plant includable content (e.g., log/upload poisoning). |
| Impact | Signals are mixed and point toward a moderate, not urgent, priority. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N) describes a network-reachable but authenticated (PR:L) flaw with high attack complexity (AC:H), which already tempers the 7.5 base score. EPSS is low at 0.46% (38th percentile), indicating little observed/predicted exploitation activity, and the issue is NOT on CISA KEV and has no public exploit identified at time of analysis - so there is no evidence of real-world weaponization. There is a notable terminology conflict in the source data: the title/CWE-98 describe 'PHP Remote File Inclusion' while the description body explicitly states the realized impact is 'PHP Local File Inclusion'; treat this as LFI (local include of attacker-influenced paths) rather than true remote URL inclusion - verify with the Patchstack advisory. The combination of required authentication, high complexity, low EPSS, and absence of KEV/POC makes this a 'patch in normal cycle' item rather than an emergency, though LFI on WordPress can escalate to code execution if log/upload poisoning is possible, so it should not be dismissed outright. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated WordPress account (per PR:L) on a site running The7 Elements <= 2.7.11 abuses a plugin parameter that controls an include/require path to load an arbitrary local PHP/file from the server. Under favorable conditions this can expose sensitive configuration data or escalate to code execution by including a previously poisoned file (e.g., logs or uploads). No public exploit is identified at time of analysis, and the high attack complexity (AC:H) implies non-trivial prerequisites to trigger reliably. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
PHP local file inclusion in the The7 Elements plugin (dt-the7-core) for WordPress, affecting versions up to and including 2.7.11, allows an authenticated low-privilege user to influence the path passed to an include/require statement and read files from the web server. Exploitation requires a valid session on the target WordPress site and precise conditions (CVSS AC:H, PR:L), so impact is real but not trivially reachable; escalation to PHP code execution would additionally depend on planting includable content such as poisoned logs or uploaded files. There is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV); EPSS sits at roughly 0.46% (38th percentile), consistent with a moderate rather than urgent priority.
RemediationAI
No fixed version is stated in the provided data, so the immediate action is to consult the vendor/Patchstack advisory and upgrade the The7 Elements (dt-the7-core) plugin to the newest release published after 2.7.11, then verify the installed version string. Where upgrading cannot be done promptly, compensating controls are warranted: remove or deactivate the plugin if the The7 functionality it supports is not in active use (this is the cleanest mitigation but breaks dependent theme features); tighten role capabilities so only fully trusted administrators retain access to the plugin's administrative and AJAX/REST endpoints, since the assessed vector requires only a low-privileged authenticated account; and deploy WAF or reverse-proxy rules that reject path-traversal sequences (../, ..%2f, php://filter, php://input, data://) in requests hitting dt-the7-core endpoints, accepting that such rules are heuristic and can be bypassed by encoding tricks. Because the primitive is file inclusion, also consider hardening PHP itself by confirming allow_url_include is Off, restricting open_basedir to the WordPress document root and plugin directories, and monitoring web-server logs for traversal-shaped requests against the plugin path as an early indicator of attempted exploitation. Rotate any secrets contained in files readable from the web server if compromise is suspected.
Affected ProductsAI
The affected product is the The7 Elements plugin for WordPress, distributed under the slug dt-the7-core by the vendor Dream-Theme, which is normally installed alongside the commercial The7 theme. All versions from the initial release through and including 2.7.11 are reported as vulnerable in the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/dt-the7-core/vulnerability/wordpress-the7-elements-plugin-2-7-11-local-file-inclusion-vulnerability?_s_id=cve). No CPE identifiers were supplied in the available intelligence, so identification should be performed by checking the installed plugin version under wp-content/plugins/dt-the7-core/ on each WordPress instance; any site running 2.7.11 or earlier is in scope.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified under CWE-98, 'Improper Control of Filename for Include/Require Statement in PHP Program', the classic PHP file-inclusion weakness. In its modern incarnation this class most often manifests as local file inclusion rather than remote file inclusion, because default PHP configurations ship with allow_url_include disabled; the description supplied here explicitly frames the practical impact as PHP Local File Inclusion, even though the CWE label retains the historic 'Remote File Inclusion' name. The root cause is that the dt-the7-core plugin component of the Dream-Theme The7 Elements package constructs an include or require path from input that a user can influence without adequately constraining it (for example, without validating against an allow-list or stripping traversal sequences such as ../). Because the resulting path is resolved by the PHP interpreter on the host, an attacker who can steer it can cause the server to read and evaluate files outside the intended plugin directory. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H confirms network reachability, a high attack-complexity rating, and a low-privileged authenticated attacker, with high confidentiality, integrity and availability weighting if the primitive is fully leveraged; the high complexity reflects the additional non-default setup or path-control precision needed to make the inclusion deterministic rather than a simple unauthenticated lookup.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress plugin endpoint but needs an authenticated account (PR:L) and non-trivial path control (AC:H); LFI can yield file read and code execution, so C/I/A:H, scope unchanged.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
DescriptionCVE.org
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 Elements dt-the7-core allows PHP Local File Inclusion.This issue affects The7 Elements: from n/a through <= 2.7.11.
Executive ViewAI
The7 Elements (dt-the7-core), a companion plugin bundled with the widely deployed commercial The7 WordPress theme, is affected up to and including version 2.7.11 by a local file inclusion weakness that allows an authenticated low-privilege user to read files from the web server. Any organization hosting WordPress sites built on this theme inherits the exposure, and because such plugins are often installed as theme dependencies, many site owners may not have it inventoried at all. Successful file reads could expose configuration secrets and credentials, and while there is no vendor patch available and no public exploit identified at time of analysis, the flaw is real and requires remediation planning rather than emergency escalation.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict the plugin to trusted, minimal user roles (the vulnerability is authenticated and requires a valid session), harden file system permissions and move or protect wp-config.php and other sensitive files outside predictable include paths, deploy WAF rules blocking path traversal and suspicious include parameters against dt-the7-core endpoints, monitor web server and application logs for unexpected file access, and isolate or remove the plugin on sites where it is not required until a fixed release is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC
Exploit-DB