Cyber Resilience

CVE-2025-48290

High

Published: 06 November 2025

Published
06 November 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 31.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-48290 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-48290 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98), affecting the Kinsley WordPress theme developed by bslthemes. This flaw impacts Kinsley versions from n/a through 3.4.4 and was published on 2025-11-06.

The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation by unauthenticated attackers over the network with high attack complexity and no user interaction. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially enabling local file disclosure or manipulation through improper handling of include/require statements.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/kinsley/vulnerability/wordpress-kinsley-theme-3-4-4-local-file-inclusion-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP Local File Inclusion.This issue affects Kinsley: from n/a through <= 3.4.4.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

Public-facing WordPress theme vulnerability enables unauthenticated remote exploitation (T1190). LFI allows arbitrary local file inclusion, facilitating data collection from local system (T1005) and file/directory discovery (T1083).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-69398Shared CWE-98
CVE-2026-22425Shared CWE-98
CVE-2025-58933Shared CWE-98
CVE-2025-58896Shared CWE-98
CVE-2026-22380Shared CWE-98
CVE-2025-67946Shared CWE-98
CVE-2026-28097Shared CWE-98
CVE-2025-68545Shared CWE-98
CVE-2026-24609Shared CWE-98
CVE-2025-58898Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of information inputs such as filenames used in PHP include/require statements, directly preventing malicious local file inclusion by rejecting invalid or dangerous paths.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates identification, reporting, and correction of system flaws like this PHP file inclusion vulnerability in the Kinsley WordPress theme, ensuring timely patching up to version 3.4.4.

SC-7 Boundary Protection partial match
preventdetect

SC-7 enforces boundary protection via mechanisms like web application firewalls that can block or detect network-based exploitation attempts targeting the file inclusion flaw.

References