CVE-2025-53432
Published: 18 December 2025
Summary
CVE-2025-53432 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-53432 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Echo WordPress theme developed by AncoraThemes. This issue affects Echo versions from n/a through 1.15.0. Published on 2025-12-18T08:15:53.440, it carries a CVSS v3.1 base score of 8.1 (High) with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and is associated with CWE-98.
A remote attacker with no privileges can exploit this vulnerability over the network, requiring high attack complexity but no user interaction. Exploitation allows high-impact outcomes on confidentiality, integrity, and availability, such as unauthorized access to local files or potential code execution via inclusion of local PHP files.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/echo/vulnerability/wordpress-echo-theme-1-15-0-local-file-inclusion-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204218
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Echo echo allows PHP Local File Inclusion.This issue affects Echo: from n/a through <= 1.15.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application via unauthenticated remote access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 requires validation of untrusted inputs such as filenames in PHP include/require statements, directly preventing exploitation of this improper filename control vulnerability leading to local file inclusion.
SI-2 mandates timely flaw remediation, directly addressing this specific LFI vulnerability in the Echo WordPress theme by applying patches for affected versions <=1.15.0.
SC-7 provides boundary protection via web application firewalls or proxies that filter and block malicious file inclusion payloads targeting this PHP vulnerability.