EUVD-2025-27723CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme DSK allows PHP Local File Inclusion. This issue affects DSK: from n/a through 2.2.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in the snstheme DSK WordPress theme (versions up to 2.2) that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability stems from improper input validation on filename parameters in PHP include/require statements, potentially enabling attackers to read sensitive files, execute code, or compromise the entire WordPress installation. This is a high-severity issue (CVSS 8.1) affecting a popular theme, though real-world exploitation requires moderate attack complexity (AC:H).
Technical ContextAI
The vulnerability exists in the snstheme DSK WordPress theme (CPE identifier likely: cpe:2.3:a:snstheme:dsk:*:*:*:*:*:wordpress:*:*) and represents a classic PHP Remote/Local File Inclusion (RFI/LFI) weakness categorized under CWE-98 ('Improper Control of Filename for Include/Require Statement in PHP Program'). The root cause is insufficient validation of user-supplied input before it is passed to PHP's include(), require(), include_once(), or require_once() functions. Attackers can manipulate file paths through GET/POST parameters or cookies to access files outside the intended directory scope, leveraging directory traversal sequences (../) or null-byte injection (in older PHP versions) to bypass path restrictions. The vulnerability affects DSK versions from an unspecified baseline through version 2.2, indicating the flaw has existed in the theme for multiple releases.
RemediationAI
Update snstheme DSK to version 2.3 or later (assumed fix version based on '≤ 2.2' language; verify with vendor advisory); priority: Immediate Vendor Advisory: Check snstheme official website or WordPress.org theme repository for security advisory and patch release notes; link: https://wordpress.org/themes/dsk/ (assumed repository URL) Workaround (if patch unavailable): Implement Web Application Firewall (WAF) rules to block requests containing directory traversal patterns (../, ..\ null-bytes, or suspicious file paths like /etc/passwd, wp-config.php) in user input parameters Mitigation: Disable theme if not critical; use alternative theme from verified developers; restrict access to theme files via .htaccess or nginx configuration Detection: Scan server logs for requests with encoded traversal sequences (%2e%2e%2f) or file path parameters; use WordPress security plugins (e.g., Wordfence, Sucuri) to detect/block exploitation attempts
Share
External POC / Exploit Code
Leaving vuln.today