What is the CVSS score of EUVD-2025-17481?

EUVD-2025-17481 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2025-17481?

A high-severity vulnerability in CraftXtore (versions through 1.7) allows attackers to include and execute arbitrary files on affected systems, potentially leading to unauthorized access and data…

How to fix or mitigate EUVD-2025-17481?

Within 24 hours: Identify all systems running CraftXtore and assess exposure; enable detailed logging and monitoring for suspicious file inclusion attempts. Within 7 days: Implement compensating controls (WAF rules blocking suspicious include parameters, restrict PHP file access, disable affected functionality if non-critical). Within 30 days: Establish vendor communication channel to track patch availability; evaluate alternative solutions or plan controlled upgrade path once patch is released.

PHP EUVD-2025-17481

| CVE-2025-24770 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17481

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme CraftXtore allows PHP Local File Inclusion. This issue affects CraftXtore: from n/a through 1.7.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in BZOTheme CraftXtore versions up to 1.7 that allows unauthenticated remote attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. The vulnerability has a CVSS score of 8.1 (high severity) with network accessibility and high impact to confidentiality, integrity, and availability. Exploitation requires moderate attack complexity but no user interaction or privileges, making it a significant risk if actively exploited or proof-of-concept code becomes public.

Technical ContextAI

This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP-specific vulnerability class where user-controlled input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. The root cause is the absence of input validation and sanitization on filename parameters before they are used in file inclusion operations. In the context of BZOTheme CraftXtore (a WordPress theme framework), the vulnerability likely exists in template loading, configuration file inclusion, or plugin loader mechanisms where user input or HTTP parameters are directly concatenated into file paths. While initially described as 'Remote File Inclusion' (RFI), the CVE description clarifies this is actually 'Local File Inclusion' (LFI), meaning attackers can access files already present on the server (e.g., /etc/passwd, application source code, configuration files containing credentials) rather than including files from remote servers. CPE identification would typically target: cpe:2.3:a:bzotheme:craftxtore:*:*:*:*:*:*:*:* (versions through 1.7).

RemediationAI

IMMEDIATE: Identify all WordPress installations using BZOTheme CraftXtore and determine current version via wp-admin or theme metadata. 2. PATCH: Upgrade to the latest version of CraftXtore released after this CVE disclosure (vendor should release version 1.8 or higher with validation controls; specific patch version not provided in available data—check BZOTheme release notes and WordPress.org theme directory). 3. WORKAROUND (temporary, if patching is delayed): Implement a Web Application Firewall (WAF) rule blocking common LFI patterns (e.g., requests containing '../', 'php://', 'file://', or attempts to access sensitive paths like /etc/passwd or wp-config.php). 4. CODE-LEVEL MITIGATION: Review any custom theme modifications that handle file inclusion. Implement strict input validation: whitelist allowed filenames/paths, use basename() to strip directory traversal, validate against a list of permitted files, and avoid passing user input directly to include/require. 5. MONITORING: Enable access logging and search for suspicious path traversal sequences in theme-related requests to detect exploitation attempts. 6. DISABLE THEME (if unpatched and high-risk): Temporarily switch to a well-maintained alternative theme while patching is prepared.