What is the CVSS score of EUVD-2025-210042?

EUVD-2025-210042 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cookiteer WordPress Theme are affected by EUVD-2025-210042?

The androThemes Cookiteer WordPress theme (versions 1.4.8 and earlier) contains a file inclusion vulnerability allowing unauthenticated remote attackers to execute arbitrary code and access sensitive…

How to fix or mitigate EUVD-2025-210042?

Within 24 hours: Identify all WordPress installations using Cookiteer theme version 1.4.8 or earlier; immediately disable or uninstall the theme as emergency mitigation. Within 7 days: Contact androThemes for patch timeline and release status; conduct forensic review of web server and application logs for file inclusion exploitation attempts. Within 30 days: Migrate to a patched Cookiteer release (when available) or replace with an alternative WordPress theme; establish a security review process for future theme deployments.

Cookiteer WordPress Theme EUVD-2025-210042

| CVE-2025-68886 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 audit@patchstack.com

GHSA-fq3v-86hj-cq43

LFI Information Disclosure PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 14:33 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion.

This issue affects Cookiteer: from n/a through 1.4.8.

AnalysisAI

Local File Inclusion in androThemes Cookiteer WordPress theme versions up to and including 1.4.8 allows remote unauthenticated attackers to include and execute arbitrary local PHP files on the underlying server. The flaw is classified as PHP Remote File Inclusion (CWE-98) but the practical impact described is LFI, which can lead to sensitive information disclosure and potential code execution through log poisoning or session file abuse. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Cookiteer is a WordPress theme published by androThemes. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning user-controllable input flows into a PHP include(), require(), include_once(), or require_once() statement without adequate sanitization or allow-list validation. In WordPress theme code this typically occurs when a query parameter, POST body field, or cookie is concatenated into a path passed to one of these statements, allowing path traversal sequences or absolute paths to reference arbitrary local files. While the CWE-98 class also covers Remote File Inclusion when allow_url_include is enabled, Patchstack characterizes this specific instance as LFI only.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory lists the issue as affecting 'n/a through 1.4.8' with no confirmed fixed version, so administrators should monitor the androThemes Cookiteer changelog and the Patchstack entry at https://patchstack.com/database/wordpress/theme/cookiteer/vulnerability/wordpress-cookiteer-theme-1-4-8-local-file-inclusion-vulnerability for an updated release and upgrade as soon as one is published. Until a patched version is available, deactivate and remove the Cookiteer theme if a replacement is feasible (side effect: site appearance must be migrated to another theme), or place the WordPress instance behind a WAF (Patchstack, Wordfence, Cloudflare managed rules) with rules that block path traversal patterns and PHP wrapper schemes such as '../', 'php://filter', 'data://' against theme endpoints (side effect: may cause false positives on legitimate parameters). Additionally, set PHP's open_basedir to restrict include() to the WordPress directory and ensure allow_url_include is Off in php.ini to neutralize any RFI variant (side effect: minor; may break poorly-written plugins that rely on remote includes).