What is the CVSS score of CVE-2026-25382?

CVE-2026-25382 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25382?

IdealAuto WordPress theme versions before 3.8.6 contain a local file inclusion vulnerability allowing unauthenticated remote attackers to read arbitrary server files, potentially exposing database…. A patch is available.

How to fix or mitigate CVE-2026-25382?

Within 24 hours: Identify all WordPress installations using IdealAuto theme and document current versions via admin dashboard or WP-CLI. Within 7 days: Update IdealAuto theme to version 3.8.6 or later through WordPress admin panel (Appearance > Themes > Updates). Within 30 days: Conduct post-update verification and review access logs for exploitation indicators (requests to wp-content/themes/idealAuto containing unusual file paths or ../ traversal patterns).

PHP CVE-2026-25382

EUVD-2026-15701 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-66q5-m54j-76xc

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:14 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.8.6

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15701

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes IdealAuto idealauto allows PHP Local File Inclusion.This issue affects IdealAuto: from n/a through < 3.8.6.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in jwsthemes IdealAuto WordPress theme versions prior to 3.8.6, where improper control of filenames in PHP include/require statements allows attackers to read arbitrary files from the affected server. An unauthenticated remote attacker can exploit this vulnerability to disclose sensitive information such as configuration files, database credentials, and other system files. This vulnerability has been documented by Patchstack and tracked under EUVD-2026-15701; no CVSS score is currently assigned, though the tags indicate it enables information disclosure through PHP-based file inclusion.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a well-known weakness in PHP applications where user-supplied input is not properly validated before being passed to file inclusion functions such as include(), require(), include_once(), or require_once(). The IdealAuto theme (cpe:2.3:a:jwsthemes:idealauto:*:*:*:*:*:*:*:*) likely accepts a filename or path parameter through a GET, POST, or COOKIE parameter without sanitization or whitelisting, enabling an attacker to traverse the filesystem and include files outside the intended directory. While the CVE description mentions both Remote File Inclusion (RFI) and Local File Inclusion (LFI) capabilities, the actual vulnerability manifests as an LFI, allowing disclosure of local files such as wp-config.php, /etc/passwd, or other sensitive application files.

RemediationAI

Organizations should immediately upgrade jwsthemes IdealAuto to version 3.8.6 or later, which patches this vulnerability. The upgrade can be performed through the WordPress admin dashboard (Appearance > Themes > Updates) or by manually downloading the latest version from the theme's official distribution channel. Until patching is completed, network-level mitigations should be implemented, including restricting access to wp-admin and wp-json endpoints via IP whitelisting, disabling PHP execution in non-essential directories (wp-content/uploads, wp-content/cache) through .htaccess or web server configuration, and monitoring access logs for suspicious file inclusion patterns such as requests containing path traversal sequences (../, ..\, or encoded variants). Additionally, Web Application Firewalls (WAF) can be configured to block requests containing common LFI payloads. For organizations unable to patch immediately, consider temporarily disabling the IdealAuto theme and switching to a default WordPress theme until an upgrade is feasible.