Cyber Resilience

CVE-2025-27010

High

Published: 19 May 2025

Published
19 May 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0122 79.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27010 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 20.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-27010 is a path traversal vulnerability (CWE-35) in the bslthemes Tastyc WordPress theme that permits PHP local file inclusion. The flaw stems from improper handling of sequences such as '.../...//' and affects all versions through 2.5.1.

Unauthenticated remote attackers can supply crafted path sequences over the network to include and execute arbitrary local PHP files on the server. Successful exploitation yields full control over the confidentiality, integrity, and availability of the affected installation, consistent with the CVSS 8.1 rating that reflects high complexity but no required privileges or user interaction.

The Patchstack advisory for the issue states that the vulnerability is resolved by updating the Tastyc theme to version 2.5.2 or later. The associated EPSS score remains low at 0.0122 with no material increase observed since disclosure.

EU & UK References

Vulnerability details

Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.

CWE(s)
CWE-35

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References