What is the CVSS score of CVE-2025-64287?

CVE-2025-64287 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Alloggio Hotel Booking are affected by CVE-2025-64287?

The Alloggio Hotel Booking WordPress theme (versions through 1.8) contains a local file inclusion vulnerability that could allow attackers to read sensitive server files and potentially execute…

How to fix or mitigate CVE-2025-64287?

Within 24 hours: Identify all WordPress installations using Alloggio theme and document current version numbers. Within 7 days: Disable or remove the vulnerable theme from all production environments; migrate to an alternative hotel booking theme or request update from vendor. Within 30 days: Implement WordPress security hardening (disable file editing, restrict file permissions to 0644/0755, enable security headers) and conduct server log review for suspicious file access patterns.

Alloggio Hotel Booking CVE-2025-64287

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:21 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP Local File Inclusion.This issue affects Alloggio - Hotel Booking: from n/a through <= 1.8.

AnalysisAI

Local file inclusion in Alloggio - Hotel Booking WordPress theme through version 1.8 allows remote attackers to read arbitrary files on the server and potentially execute code by manipulating PHP include/require statements. The vulnerability stems from improper filename validation in file inclusion operations, enabling attackers to traverse directories and access sensitive files or configuration data. Exploitation probability is low (EPSS 0.07%, 22nd percentile) with no confirmed active exploitation or public proof-of-concept at time of analysis.

Technical ContextAI

This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement) in WordPress theme code. PHP's include() and require() functions can be manipulated when user-controlled input influences the file path parameter without proper sanitization. Attackers use directory traversal sequences (../) or null byte injection to force the application to include unintended local files. While tagged as both RFI (Remote File Inclusion) and LFI (Local File Inclusion), the actual vulnerability classification points to LFI given the CWE-98 designation. The affected component is the Alloggio theme by Edge-Themes for WordPress installations, where theme-level PHP code likely accepts unsanitized parameters that are passed directly to file inclusion functions.

Affected ProductsAI

The vulnerability affects Edge-Themes Alloggio - Hotel Booking WordPress theme versions 1.8 and earlier. All installations running version 1.8 or below are vulnerable regardless of WordPress core version. The vendor advisory and technical details are available at Patchstack database: https://patchstack.com/database/Wordpress/Theme/alloggio/vulnerability/wordpress-alloggio-hotel-booking-theme-theme-1-8-local-file-inclusion-vulnerability. Organizations using this theme for hotel booking functionality on WordPress sites should verify their installed version immediately.

RemediationAI

Upgrade to Alloggio theme version 1.9 or later if available from Edge-Themes, as the version boundary (through 1.8) suggests a patched release exists. Verify the update through the WordPress admin dashboard or directly from the theme vendor. If immediate patching is unavailable, implement these compensating controls: Disable the Alloggio theme and switch to a different WordPress theme until patches are applied (trade-off: loss of hotel booking functionality and site appearance). Configure web application firewall rules to block requests containing directory traversal sequences (../, .%2e, %2e%2e) in URL parameters and POST data targeting theme directories (wp-content/themes/alloggio/). Restrict filesystem permissions so the web server user cannot read sensitive files like wp-config.php outside the theme directory (use 640 permissions for config files, 755 for directories). Review server logs for suspicious requests to theme PHP files with file path parameters. For complete technical remediation guidance, consult the Patchstack advisory at the reference URL above.