CVE-2025-53248
Published: 28 August 2025
Summary
CVE-2025-53248 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific flaw in the PHP include/require statement handling within the vulnerable WordPress theme versions.
Enforces validation of user-supplied filenames and paths to block malicious inputs enabling local file inclusion via improper control.
Establishes restrictive PHP configuration settings like open_basedir to limit the scope of file access and prevent arbitrary local file inclusion.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme directly enables remote exploitation (T1190) and arbitrary PHP code execution via file inclusion (T1059).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine eximious-magazine allows PHP Local File Inclusion.This issue affects Magazine: from n/a through <= 1.2.2.
Deeper analysisAI
CVE-2025-53248 is an Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in the unfoldwp eximious-magazine WordPress theme. It allows PHP Local File Inclusion and affects all versions from n/a through 1.2.2. The vulnerability, published on 2025-08-28, carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation enables high-impact consequences across confidentiality, integrity, and availability.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/eximious-magazine/vulnerability/wordpress-magazine-theme-1-2-2-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)