ThimPress Eduma CVE-2025-64195

Exploitation requires an authenticated WordPress session on the target site: the CVSS vector specifies PR:L, so the attacker must already possess at least a low-privilege account (e.g. a self-registered subscriber), which makes open/public user registration a key enabling condition and a closed-registration site a strong limiting factor. The affected component is the ThimPress Eduma theme at versions up to and including 5.7.6, where attacker-controlled input reaches a PHP include/require statement (CWE-98) permitting Local File Inclusion. High attack complexity (AC:H) indicates additional non-default preconditions or specific input manipulation are needed, and no user interaction is required (UI:N). The practical payoff is reading local files such as wp-config.php; escalation to code execution would require additional conditions (e.g. log poisoning) not documented in the available data.

Moderate priority. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/C:H/I:H/A:H, base 7.5) tempers network reachability with two real friction factors: high attack complexity (AC:H) and a requirement for existing low-level authentication (PR:L), meaning an attacker must already hold a valid WordPress account (e.g. subscriber/author) on the target site. The signals are consistent and point to a non-trivial-to-exploit issue rather than a drive-by: EPSS is low (0.48%, 39th percentile), there is NO CISA KEV listing, and no public exploit code was identified in the provided data - so this is 'no public exploit identified at time of analysis.' The I:H/A:H impact ratings from the source look aggressive for a Local File Inclusion whose primary consequence is reading local files (confidentiality); integrity/availability would only reach High via secondary escalation such as PHP log poisoning or wrapper abuse leading to code execution, which is not confirmed here. Note also a description inconsistency: the CWE-98 title cites 'PHP Remote File Inclusion' while the body states the realized issue is 'PHP Local File Inclusion' - treat it as LFI. Overall this is a genuine but lower-tier priority: patch on a normal cadence, prioritizing sites that allow open/low-trust user registration.

An attacker who holds a low-privilege WordPress account (such as a self-registered subscriber) on a site running a vulnerable Eduma theme sends a crafted request to a theme endpoint that passes attacker-influenced input into a PHP include/require path. By manipulating the filename parameter they cause the server to include a local file such as wp-config.php, disclosing database credentials and secret keys. No public proof-of-concept was identified in the provided data, and the high attack complexity (AC:H) implies non-obvious preconditions must be met.