EUVD-2025-18644CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika allows PHP Local File Inclusion. This issue affects Nika: from n/a through 1.2.8.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in thembay Nika theme versions through 1.2.8, caused by improper control of filename parameters in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this vulnerability over the network to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or system compromise. The CVSS score of 8.1 (High) reflects significant confidentiality and integrity impact, though the AC:H (Attack Complexity: High) rating suggests some exploitation difficulty; KEV status and active exploitation data would further clarify immediate risk priority.
Technical ContextAI
This vulnerability exploits improper input validation in PHP file inclusion mechanisms (include(), require(), include_once(), or require_once() statements). CWE-98 specifically addresses the failure to properly sanitize or validate user-supplied input before using it as a filename parameter in these statements. In the thembay Nika WordPress theme (CPE likely: cpe:2.3:a:thembay:nika:*:*:*:*:*:wordpress:*:*), an attacker can manipulate HTTP request parameters to include arbitrary file paths—such as /etc/passwd (Linux) or Windows system files—or remote files if the PHP configuration allows remote file inclusion via stream wrappers (e.g., php://input, data://, or http://). The vulnerability affects versions from an unspecified baseline through 1.2.8, suggesting a regression or long-standing flaw introduced early in the theme's development.
RemediationAI
Immediate Actions: (1) Update thembay Nika theme to the latest version >1.2.8 if available—verify on thembay's website or WordPress.org theme page; (2) If no patch is available, disable or remove the Nika theme and switch to an actively maintained alternative; (3) Implement Web Application Firewall (WAF) rules to detect and block LFI patterns (e.g., ../../../, file://, php://, data://) in request parameters. Code-Level Mitigations (if source is available): (a) Sanitize and validate all user inputs used in file inclusion statements using whitelist approaches (e.g., allowlist of permitted files or directories); (b) Use basename() or realpath() to prevent directory traversal; (c) Disable dangerous PHP settings like allow_url_include and allow_url_fopen if not needed; (d) Implement strict Content Security Policy (CSP) headers to limit resource loading. Workarounds: Restrict file permissions on the web server to limit exposure of sensitive files, and monitor access logs for suspicious file inclusion patterns.
Share
External POC / Exploit Code
Leaving vuln.today