CVE-2025-4524

Deeper analysis

The Madara responsive WordPress theme for manga sites is affected by a local file inclusion vulnerability in all versions through 2.2.2. The flaw exists in the handling of the template parameter and permits inclusion of arbitrary server-side files, which in turn allows execution of PHP code contained in those files. The issue is tracked as CVE-2025-4524 and carries a CVSS 3.1 base score of 9.8.

Unauthenticated remote attackers can exploit the vulnerability over the network without any user interaction or credentials. Successful exploitation can bypass access controls, disclose sensitive information, or lead to arbitrary code execution on the host, particularly when an attacker can first upload a file containing PHP and then include it via the vulnerable parameter.

Public references include the vendor product page, a detailed Wordfence threat-intelligence entry, and a working exploit on Exploit-DB, indicating that both advisory information and proof-of-concept code are readily available. The current EPSS score of 0.1543 with a recorded peak of 0.1646 shows moderate exploitation probability but no pronounced post-disclosure climb.