What is the CVSS score of CVE-2026-25379?

CVE-2026-25379 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25379?

The jwsthemes StreamVid WordPress theme contains a local file inclusion vulnerability allowing authenticated attackers to read arbitrary files from affected servers, potentially exposing…. A patch is available.

How to fix or mitigate CVE-2026-25379?

Within 24 hours: Identify all WordPress sites using StreamVid theme and document current version numbers. Within 7 days: Update StreamVid theme to version 6.8.6 or later across all affected installations; verify update completion through theme management dashboard. Within 30 days: Conduct file access log review for indicators of exploitation; reset database credentials and API keys if any evidence of unauthorized file access is discovered.

PHP CVE-2026-25379

EUVD-2026-15696 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-7gf4-9xwp-h6w5

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:14 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

6.8.6

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15696

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through < 6.8.6.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in jwsthemes StreamVid WordPress theme versions prior to 6.8.6, where improper control of filename parameters in PHP include/require statements allows attackers to read arbitrary files from the server. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and has been documented by Patchstack with ENISA tracking ID EUVD-2026-15696. While no CVSS score or EPSS data is currently published, the LFI classification indicates potential for sensitive information disclosure including configuration files, source code, and credentials.

Technical ContextAI

The vulnerability stems from unsafe use of PHP's include() or require() functions with user-controlled input, a classic CWE-98 weakness. In the StreamVid theme (CPE: cpe:2.3:a:jwsthemes:streamvid:*:*:*:*:*:*:*:*), a filename parameter is passed directly to a PHP file inclusion statement without proper validation or sanitization. This allows attackers to traverse the directory structure using path traversal sequences (e.g., '../../../etc/passwd') or in some LFI variants, to include remote files if PHP stream wrappers are enabled. The vulnerability affects the theme's template rendering logic, which commonly processes user input through GET/POST parameters or configuration values without adequate input controls.

RemediationAI

Update the jwsthemes StreamVid theme to version 6.8.6 or later immediately through the WordPress dashboard (Appearance > Themes > Updates) or by downloading the patched version directly from the official StreamVid repository. Verify the update is complete by checking the theme version in Appearance > Themes. As an interim mitigation if immediate patching is not possible, restrict direct access to theme files via web server configuration (e.g., .htaccess or Nginx rules denying requests to suspicious parameters), implement a Web Application Firewall (WAF) rule blocking path traversal patterns (../, ..\), and enforce strict file permissions on wp-config.php and other sensitive files to limit exposure if files are accessed. Additionally, review server logs for suspicious requests containing traversal sequences and monitor file access patterns. For detailed patch notes and vendor guidance, consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/streamvid/vulnerability/wordpress-streamvid-theme-6-8-6-local-file-inclusion-vulnerability.