What is the CVSS score of EUVD-2025-17550?

EUVD-2025-17550 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2025-17550?

A path traversal vulnerability in Mikado-Themes GrandPrix (versions through 1.6) allows attackers to read arbitrary files from affected systems through PHP Local File Inclusion.

How to fix or mitigate EUVD-2025-17550?

Within 24 hours: Identify all WordPress installations using GrandPrix theme version 1.6 or earlier and assess exposure. Within 7 days: Implement WAF rules to block path traversal patterns (../, ..\, encoded variants) targeting GrandPrix template files; consider disabling the vulnerable functionality if available. Within 30 days: Monitor vendor for patch availability; plan theme upgrade or replacement; conduct file access audit to detect past exploitation.

PHP EUVD-2025-17550

| CVE-2025-49296 HIGH

Path Traversal: '.../...//' (CWE-35)

2025-06-09 audit@patchstack.com

PHP Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.8 (CRITICAL) 8.1 (HIGH)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17550

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Path Traversal vulnerability in Mikado-Themes GrandPrix allows PHP Local File Inclusion. This issue affects GrandPrix: from n/a through 1.6.

AnalysisAI

A Path Traversal vulnerability in Mikado-Themes GrandPrix WordPress theme (versions through 1.6) allows unauthenticated remote attackers to perform PHP Local File Inclusion (LFI) attacks, potentially leading to arbitrary file reading, information disclosure, and remote code execution. The vulnerability has a CVSS score of 8.1 (High) with high impact on confidentiality, integrity, and availability; exploitation requires medium attack complexity but no user interaction or privileges. KEV status and active exploitation data were not provided, but the high CVSS and LFI nature suggest significant real-world risk if POC is publicly available.

Technical ContextAI

This vulnerability exploits improper input validation in the GrandPrix WordPress theme's file handling logic, falling under CWE-35 (Path Traversal). The weakness allows attackers to manipulate file path parameters (likely via GET/POST parameters or URL manipulation) to traverse directory structures using sequences such as '../' or null bytes, enabling inclusion of arbitrary files outside the intended directory. In WordPress theme contexts, this typically affects template inclusion mechanisms, file loading functions, or custom AJAX handlers that fail to properly sanitize user-supplied paths before passing them to PHP functions like include(), require(), file_get_contents(), or similar. The vulnerability is network-accessible (AV:N) and affects PHP execution environments running WordPress with this theme active.

RemediationAI

Immediate actions: (1) Upgrade GrandPrix theme to version > 1.6 if a patched version is available from Mikado-Themes (verify on wordpress.org or vendor site); (2) If no patch is available, disable or remove the GrandPrix theme and switch to an alternative WordPress theme; (3) Implement Web Application Firewall (WAF) rules to block path traversal patterns (../, ..\ null bytes, unicode encoding variations) in HTTP requests to affected theme directories; (4) Apply WordPress security hardening: disable file editing (DISALLOW_FILE_EDIT), restrict file upload locations, apply principle of least privilege to file permissions; (5) Review server logs and file access logs for evidence of exploitation (unusual ../ patterns, inclusion of /etc/passwd, wp-config.php, or other sensitive files). Workaround (temporary): disable the theme via wp-config.php or via database if admin access is available, pending patch deployment.