What is the CVSS score of CVE-2026-25458?

CVE-2026-25458 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25458?

CVE-2026-25458 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-25458?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-25458

EUVD-2026-15740 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15740

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Moments moments allows PHP Local File Inclusion.This issue affects Moments: from n/a through <= 2.2.

AnalysisAI

The Select-Themes Moments WordPress theme versions 2.2 and earlier contain a Local File Inclusion (LFI) vulnerability that allows attackers to improperly control filename parameters in PHP include/require statements. An unauthenticated attacker can exploit this vulnerability to read arbitrary files from the affected server, potentially disclosing sensitive configuration files, source code, or other confidential information. While no CVSS score or EPSS data is currently available and no active KEV listing is confirmed, the vulnerability is catalogued by Patchstack and has been assigned EUVD-2026-15740, indicating documented exploitation potential.

Technical ContextAI

This vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which specifically addresses PHP's dynamic file inclusion functions (include(), require(), include_once(), require_once()). The affected product is the Select-Themes Moments theme (CPE: cpe:2.3:a:select-themes:moments:*:*:*:*:*:*:*:*), a WordPress theme component that runs server-side PHP code. The root cause is insufficient input validation on user-supplied parameters that are passed directly to PHP file inclusion functions, allowing path traversal techniques (e.g., ../ sequences or protocol wrappers) to specify arbitrary file paths on the server filesystem. This is a classic server-side template injection variant specific to PHP's dynamic include mechanism.

RemediationAI

Immediately upgrade the Select-Themes Moments theme to a patched version beyond 2.2; consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/moments/vulnerability/wordpress-moments-theme-2-2-local-file-inclusion-vulnerability) for the exact patched version number and installation instructions. If an immediate patch is unavailable from the vendor, disable or remove the Moments theme until a fix is released. As a compensating control, implement a Web Application Firewall (WAF) rule to detect and block common LFI payloads (e.g., requests containing ../, file://, php://, or filter:// sequences in query parameters and POST data). Additionally, restrict file system permissions on the web server to the principle of least privilege, ensuring the PHP process cannot read sensitive files outside the WordPress application directory. Monitor access logs for suspicious file inclusion attempts.