CVE-2025-68987
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows PHP Local File Inclusion.This issue affects Cinerama: from n/a through <= 2.9.
Analysis
Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.
Technical Context
This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98), commonly known as Local File Inclusion (LFI). Despite the CVE title mentioning Remote File Inclusion (RFI), the tags and Patchstack reference confirm this is an LFI vulnerability in the Cinerama WordPress theme. LFI occurs when user-supplied input is insufficiently sanitized before being passed to PHP file inclusion functions like include(), require(), or their variants. Attackers exploit this by manipulating file path parameters with directory traversal sequences (../) or absolute paths to access files outside the intended directory structure. The Edge-Themes Cinerama theme, designed for movie studios and filmmakers, contains vulnerable code that allows attackers to specify arbitrary file paths for inclusion, potentially exposing WordPress configuration files (wp-config.php), server logs, SSH keys, database credentials, and other sensitive system files through HTTP requests.
Affected Products
The vulnerability affects Edge-Themes Cinerama WordPress theme versions from an unspecified initial release through version 2.9 and earlier. Cinerama is a commercial WordPress theme marketed for movie studios, filmmakers, and entertainment industry websites. All installations running version 2.9 or below are vulnerable to unauthenticated local file inclusion attacks. The vendor advisory and detailed vulnerability information are available through Patchstack at https://patchstack.com/database/Wordpress/Theme/cinerama/vulnerability/wordpress-cinerama-a-wordpress-theme-for-movie-studios-and-filmmakers-theme-2-4-local-file-inclusion-vulnerability.
Remediation
Organizations using Edge-Themes Cinerama theme should immediately verify their installed version through the WordPress admin dashboard under Appearance > Themes. If running version 2.9 or earlier, upgrade to the latest version available from Edge-Themes or through ThemeForest. Patch availability from the vendor has not been independently confirmed from the provided data sources, so administrators should contact Edge-Themes support directly or check their ThemeForest purchase dashboard for available updates. As an interim mitigation measure, consider temporarily switching to a different WordPress theme until a patched version can be confirmed and deployed. Implement web application firewall (WAF) rules to detect and block directory traversal patterns in HTTP requests targeting theme files. Review server logs for suspicious requests containing patterns like ../ or absolute file paths in theme-related parameters. Ensure proper file permissions are set on sensitive configuration files to limit exposure even if LFI exploitation is attempted. Detailed vulnerability information and updates can be monitored through the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/cinerama/vulnerability/wordpress-cinerama-a-wordpress-theme-for-movie-studios-and-filmmakers-theme-2-4-local-file-inclusion-vulnerability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today