What is the CVSS score of CVE-2026-25457?

CVE-2026-25457 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25457?

CVE-2026-25457 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-25457?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-25457

EUVD-2026-15738 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-28r9-jxmr-8hgr

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15738

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Mixtape mixtape allows PHP Local File Inclusion.This issue affects Mixtape: from n/a through <= 2.1.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the Select-Themes Mixtape WordPress theme through version 2.1, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling information disclosure and potential remote code execution depending on file accessibility. While no CVSS score or EPSS data is currently available, the LFI classification and PHP nature of the vulnerability indicate moderate to high exploitability with network-based attack vectors.

Technical ContextAI

The vulnerability is a classic PHP Local File Inclusion (LFI) flaw categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Select-Themes Mixtape theme (identified via CPE cpe:2.3:a:select-themes:mixtape:*:*:*:*:*:*:*:*) fails to properly sanitize or validate user-supplied input before passing it to PHP's include() or require() functions. This allows attackers to manipulate file paths to load arbitrary files from the server's filesystem, such as configuration files containing credentials, system files like /etc/passwd on Linux, or previously uploaded malicious files. LFI vulnerabilities in WordPress themes are particularly impactful because themes execute in the WordPress context with access to the database, user sessions, and sensitive configuration data.

RemediationAI

Immediately upgrade the Mixtape theme to a patched version released after 2.1 if available from Select-Themes, or switch to an alternative WordPress theme if no patch is forthcoming. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/mixtape/vulnerability/wordpress-mixtape-theme-2-1-local-file-inclusion-vulnerability) for patch availability and vendor guidance. As interim mitigations, disable the Mixtape theme and revert to a default WordPress theme, implement Web Application Firewall (WAF) rules to detect and block LFI attacks (blocking common patterns like ../, etc/passwd, and file:// schemes in HTTP requests), restrict file permissions on the web server to minimize the impact of successful LFI exploitation, and audit recent access logs for signs of exploitation attempts. Additionally, consider running security scanning tools to identify if this vulnerability has been exploited on affected installations.