What is the CVSS score of EUVD-2025-17482?

EUVD-2025-17482 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2025-17482?

AncoraThemes Inset plugin versions through 1.18.0 contain a PHP Local File Inclusion vulnerability (CVE-2025-26592) that could allow attackers to access sensitive files on affected systems.

How to fix or mitigate EUVD-2025-17482?

Within 24 hours: Identify all instances of AncoraThemes Inset in your environment and document version numbers; assess whether vulnerable versions are exposed to untrusted users. Within 7 days: Implement WAF rules to block LFI attack patterns targeting the vulnerable component; consider disabling the plugin if not business-critical. Within 30 days: Monitor AncoraThemes for patch release; prepare upgrade plan; evaluate alternative plugins if patch timeline is unclear.

PHP EUVD-2025-17482

| CVE-2025-26592 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17482

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Inset allows PHP Local File Inclusion. This issue affects Inset: from n/a through 1.18.0.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in AncoraThemes Inset theme affecting versions through 1.18.0, allowing unauthenticated remote attackers to include and execute arbitrary local files on vulnerable servers. This CWE-98 vulnerability stems from improper control of filename parameters in PHP include/require statements, with a CVSS score of 8.1 (High) reflecting significant confidentiality, integrity, and availability impact. The moderate attack complexity (AC:H) suggests exploitation requires specific conditions or knowledge, though the network-accessible attack vector (AV:N) and lack of privilege requirements (PR:N) make this practically exploitable.

Technical ContextAI

The vulnerability exists in the AncoraThemes Inset WordPress theme (CPE identifier: vendor:ancorathem*:product:inset) and represents a classic PHP file inclusion flaw (CWE-98). The root cause involves improper input validation on filename parameters passed to PHP's include() or require() statements, likely in template processing or configuration loading functions. PHP Local File Inclusion (LFI) differs from Remote File Inclusion (RFI) in that it accesses files already present on the server; attackers exploit path traversal sequences (e.g., ../../../etc/passwd) or null bytes to access sensitive configuration files, source code, or system files. This is particularly dangerous in WordPress themes because they often handle user-supplied parameters without strict sanitization. The vulnerability affects Inset versions from an unspecified baseline through 1.18.0, suggesting the flaw has existed across multiple releases.

RemediationAI

Update AncoraThemes Inset to version 1.18.1 or later (specific version number not provided in references; consult vendor advisory for exact patched release). Update via WordPress dashboard (Appearance > Themes > Inset > Update if available) or via direct download from AncoraThemes. Immediate Workaround: If patch unavailable, deactivate Inset theme temporarily and switch to a maintained alternative theme pending vendor patch availability. Server-Level Mitigation: Configure PHP settings: ensure allow_url_include is disabled (default), set open_basedir to restrict file access scope, and disable remote stream wrappers if not required. Apply Web Application Firewall (WAF) rules to block common LFI traversal patterns (../../../, ..), encoded variants (%2e%2e), and null byte sequences (%00). Detection & Monitoring: Monitor web server access logs for suspicious URL patterns targeting Inset theme files with path traversal sequences or unusual file parameters. Enable WordPress security audit logging via plugins (e.g., Wordfence, Sucuri) to capture exploitation attempts. Access Control: Restrict theme file exposure: disable direct access to theme files via .htaccess rules (e.g., deny direct access to sensitive theme directories), and implement strict input validation in any custom WordPress code interacting with user-supplied file parameters.