CVE-2025-26916
Published: 10 March 2025
Summary
CVE-2025-26916 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is a PHP Remote File Inclusion issue (CWE-98) stemming from improper control of filenames in include/require statements. It affects the Pixflow Massive Dynamic WordPress theme for all versions through 8.2.
Unauthenticated remote attackers can exploit the flaw over the network, though the attack requires high complexity. Successful exploitation grants them the ability to include arbitrary files, resulting in full compromise of confidentiality, integrity, and availability with changed scope that can impact other components beyond the vulnerable theme.
The primary advisory reference from Patchstack describes the issue as an unauthenticated local file inclusion vulnerability in the same theme version range and points to associated database records for further details.
EPSS scores for the CVE rose from a low baseline to a peak of 0.0294, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7717
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pixflow Massive Dynamic massive-dynamic.This issue affects Massive Dynamic: from n/a through <= 8.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
This is an unauthenticated remote/local file inclusion vulnerability in a public-facing WordPress theme that enables arbitrary code execution on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the PHP Remote File Inclusion vulnerability by requiring timely patching and remediation of the flaw in the Massive Dynamic WordPress theme.
Requires validation of user-supplied filenames in PHP include/require statements to block malicious remote file paths.
Ensures secure baseline configuration of PHP settings, such as disabling allow_url_include, to prevent remote file inclusion exploits.