EUVD-2025-17480
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Nitan allows PHP Local File Inclusion. This issue affects Nitan: from n/a through 2.9.
Analysis
PHP Local File Inclusion (LFI) vulnerability in snstheme Nitan theme affecting versions through 2.9, allowing unauthenticated remote attackers to include and execute arbitrary local files on the server. While the CVSS score of 8.1 indicates high severity with potential for confidentiality, integrity, and availability impact, the attack complexity is marked as HIGH, suggesting exploitation requires specific conditions or server configurations. The vulnerability stems from improper validation of filename parameters in PHP include/require statements (CWE-98), a classic but dangerous class of web application flaws.
Technical Context
The vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a weakness in how PHP applications handle file inclusion. When PHP's include(), require(), include_once(), or require_once() functions receive unsanitized user input as the filename parameter, attackers can traverse the filesystem to include arbitrary files. In this case, the snstheme Nitan WordPress theme fails to properly validate or sanitize filename inputs, allowing Local File Inclusion (LFI). While the CVE description mentions 'Remote File Inclusion' (RFI), the technical details specify LFI, which is the actual vulnerability. LFI attacks typically leverage PHP wrappers (php://filter, php://input) or path traversal sequences (../) to access sensitive files like wp-config.php, /etc/passwd, or application source code. The affected product is identified as snstheme's Nitan theme, likely distributed through WordPress.org or premium channels, affecting WordPress installations running vulnerable versions.
Affected Products
- vendor: snstheme; product: Nitan; affected_versions: n/a through 2.9; type: WordPress Theme; severity: CVE-2025-24768 - CVSS 8.1; notes: All versions up to and including 2.9 are affected. Exact vendor advisory URL not provided in available references; check snstheme official site or WordPress.org theme directory for patch details.
Remediation
Upgrade snstheme Nitan to version 2.10 or later (assumed to be available; verify with vendor). No specific patch version provided in data; contact snstheme or check WordPress plugin/theme update mechanism. Mitigation: If immediate patching is not possible: Disable file inclusion features in the theme if configurable; implement Web Application Firewall (WAF) rules to block LFI payloads (e.g., sequences like '../', 'php://', 'phar://'). Mitigation: Harden PHP configuration: Set allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent remote file inclusion vectors. Monitoring: Monitor server logs for suspicious include/require patterns or attempts to access sensitive files (wp-config.php, .env files). Implement file integrity monitoring (FIM) on configuration files. Workaround: Temporarily disable or deactivate the Nitan theme and switch to an alternative theme until patch is available.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today