What is the CVSS score of CVE-2025-64359?

CVE-2025-64359 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Consulting theme are affected by CVE-2025-64359?

The StylemixThemes Consulting WordPress theme contains a local file inclusion vulnerability (CVE-2025-64359) affecting all versions before 6.7.5, allowing authenticated users to execute arbitrary…

How to fix or mitigate CVE-2025-64359?

Within 24 hours, audit all WordPress installations to identify use of the StylemixThemes Consulting theme; disable the theme immediately if not business-critical and restrict administrator access to essential personnel. Within 7 days, implement file integrity monitoring on wp-config.php and enable detailed application logging of file inclusion operations to detect exploitation attempts. Within 30 days, upgrade to StylemixThemes Consulting theme version 6.7.5 or later when available, and deploy WAF rules to detect local file inclusion attack patterns.

Consulting theme CVE-2025-64359

HIGH

PHP Remote File Inclusion (CWE-98)

2025-10-31 audit@patchstack.com

PHP WordPress Information Disclosure LFI Wordpress Theme

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Network-reachable but needs an authenticated low-priv account (PR:L) and a specific include path (AC:H); LFI yields high confidentiality but limited integrity and no clear availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:00 vuln.today

CVE Published

Oct 31, 2025 - 12:15 cve.org

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through < 6.7.5.

AnalysisAI

Local File Inclusion in the StylemixThemes 'Consulting' WordPress theme (all versions up to but not including 6.7.5) lets an authenticated attacker control a filename passed to a PHP include/require statement, forcing the server to include and execute local files. Because arbitrary local PHP files can be executed, this can escalate to disclosure of sensitive files (wp-config.php credentials) and potential code execution via log poisoning or session/upload files. Reported by Patchstack; no public exploit identified at time of analysis, and EPSS is low at 0.05% (16th percentile).

Technical ContextAI

The affected component is the 'Consulting' commercial WordPress theme from StylemixThemes, which runs as PHP within a WordPress installation. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement, 'PHP Remote File Inclusion'), where user-influenced input reaches a PHP include()/require() call without proper allow-listing or path sanitization. In practice this manifests as Local File Inclusion (LFI): an attacker manipulates a parameter (e.g., a template, module, or page identifier) so the theme includes an unintended path on the server. Any included PHP file is executed in the WordPress context, and non-PHP files can be disclosed as source. No specific CPE string was provided in the input beyond the theme identity.

Affected ProductsAI

The affected product is the StylemixThemes 'Consulting' WordPress theme, versions from an unspecified earliest release through any version prior to 6.7.5 (i.e., < 6.7.5). No CPE string was supplied in the input. The vendor/vulnerability record is published via Patchstack at https://patchstack.com/database/Wordpress/Theme/consulting/vulnerability/wordpress-consulting-theme-6-7-5-local-file-inclusion-vulnerability?_s_id=cve. WordPress core itself is not affected - only sites running this specific theme.

RemediationAI

Vendor-released patch: update the Consulting theme to version 6.7.5 or later, which is the first fixed release per the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/consulting/vulnerability/wordpress-consulting-theme-6-7-5-local-file-inclusion-vulnerability?_s_id=cve). If immediate upgrade is not possible, apply compensating controls: use a WAF or Patchstack's vPatch/virtual patching to block requests containing path-traversal sequences or suspicious file parameters aimed at theme endpoints; restrict access to theme functionality by tightening the roles/capabilities of low-privileged accounts (since PR:L is required); and harden PHP with open_basedir and allow_url_include=Off to limit which files an include can reach - noting that overly tight open_basedir settings can break legitimate plugins/themes and should be tested in staging. Removing or deactivating the theme entirely eliminates exposure but will disable the site's front-end presentation.