CVE-2025-39360

Deeper analysis

CVE-2025-39360 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include/require statements, classified under CWE-98. It affects the Grace Mag WordPress theme by everestthemes, impacting all versions through 1.1.5. The flaw carries a CVSS 3.1 score of 7.5 with a network attack vector, high attack complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality, integrity, and availability.

An unauthenticated remote attacker can exploit the issue by supplying a crafted filename that causes the theme to include arbitrary local PHP files. Successful exploitation allows the attacker to read sensitive files, execute code, or achieve further compromise of the affected WordPress installation.

The primary advisory published by Patchstack details the vulnerability and is available at the provided reference URL, which security teams can consult for version-specific guidance and remediation steps.

EPSS for this CVE rose from a low baseline to a peak of 0.0217 on 2026-06-04 before receding to the current value of 0.0075, indicating a temporary increase in observed exploitation interest after disclosure.