What is the CVSS score of EUVD-2026-15697?

EUVD-2026-15697 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2026-15697?

The jwsthemes Feedy WordPress theme contains an unauthenticated local file inclusion vulnerability (CVE-2026-25380) that allows attackers to read arbitrary files from affected servers, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-15697?

Within 24 hours: Identify all WordPress installations using jwsthemes Feedy theme and document current versions. Within 7 days: Update Feedy theme to version 2.1.5 or later across all affected WordPress sites. Within 30 days: Conduct file access log review for suspicious requests (particularly those containing file path traversal patterns), rotate database credentials if exposure is suspected, and verify no unauthorized access to sensitive configuration files occurred.

PHP EUVD-2026-15697

| CVE-2026-25380 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-f22x-p3pj-97vr

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:14 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.1.5

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15697

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes Feedy feedy allows PHP Local File Inclusion.This issue affects Feedy: from n/a through < 2.1.5.

AnalysisAI

A PHP Local File Inclusion (LFI) vulnerability exists in jwsthemes Feedy theme versions prior to 2.1.5, stemming from improper control of filenames in PHP include/require statements. This vulnerability allows unauthenticated attackers to read arbitrary files from the affected server, potentially exposing sensitive configuration files, database credentials, and other confidential information. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement) and was reported by Patchstack, affecting WordPress installations using the vulnerable Feedy theme.

Technical ContextAI

The vulnerability exists in the Feedy WordPress theme (CPE: cpe:2.3:a:jwsthemes:feedy:*:*:*:*:*:*:*:*) and represents a classic PHP file inclusion flaw categorized under CWE-98. The root cause involves insufficient input validation and sanitization of user-supplied parameters that are passed directly to PHP include() or require() statements without proper filtering. This allows attackers to manipulate file path parameters to include arbitrary local files on the server, such as /etc/passwd, wp-config.php, or other sensitive files. Unlike Remote File Inclusion (RFI), LFI restricts attacks to files accessible on the same server, but the impact remains severe for information disclosure and potential credential theft.

RemediationAI

Immediately upgrade the Feedy theme to version 2.1.5 or later, which includes the security patch for this LFI vulnerability. The upgrade can typically be performed through the WordPress theme management interface or directly via the jwsthemes vendor dashboard. For organizations unable to patch immediately, implement the following interim controls: restrict access to the WordPress installation via Web Application Firewall (WAF) rules that block suspicious file path traversal patterns (../, encoded variants), disable PHP script execution in upload directories via .htaccess or web server configuration, and implement strict input validation and sanitization on all user-supplied parameters passed to file inclusion functions. Monitor web server logs for exploitation attempts targeting file inclusion parameters. See the vendor advisory at https://patchstack.com/database/Wordpress/Theme/feedy/vulnerability/wordpress-feedy-theme-2-1-5-local-file-inclusion-vulnerability for patch availability and additional mitigation guidance.