PHP CVE-2026-25457

Remote unauthenticated attacker can exploit Select-Themes Mixtape plugin versions <= 2.1 through PHP Local File Inclusion. Requires AC:H conditions (likely specific PHP configuration or parameter manipulation). No victim interaction needed. Affects WordPress installations with vulnerable Mixtape plugin enabled.

Despite the absence of published CVSS and EPSS scores, multiple signals indicate this is a genuine security concern. The LFI classification is inherently exploitable with low attack complexity—typically requiring only manipulation of URL parameters or form inputs. The vulnerability affects all versions of Mixtape through 2.1 with no apparent patch boundary indicated, suggesting a prolonged exposure window. The lack of CVSS vector data and KEV/POC confirmation prevents definitive SSVC scoring, but LFI vulnerabilities in widely-deployed WordPress themes typically have high real-world exploitation probability. The ENISA EUVD tracking (EUVD-2026-15738) and Patchstack reporting indicate vendor awareness. The primary risk vector is information disclosure through reading local files, with secondary risk if combined with file upload functionality or access to PHP session files. Given WordPress's ubiquity, this should be treated as a moderate-to-high priority despite missing quantitative severity metrics.

An attacker discovers a WordPress site running Mixtape theme version 2.1 and identifies an unvalidated parameter in the theme's template loading mechanism (e.g., a GET parameter like ?template=). The attacker crafts a request such as http://target.com/?template=../../wp-config.php to retrieve the WordPress configuration file containing database credentials and authentication salts. Alternatively, they could target files like /proc/self/environ on Linux systems to gather environment information, or attempt to include previously uploaded malicious PHP files to achieve code execution. Because LFI exploits typically require only HTTP requests with no authentication, the attack vector is network-based with low complexity, making it accessible to script-kiddie level attackers using automated scanning and exploitation tools.