CVE-2025-53441
Published: 18 December 2025
Summary
CVE-2025-53441 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Greeny. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-53441 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Greeny WordPress theme developed by axiomthemes. The issue impacts all versions of Greeny up to and including 2.6, with no lower bound specified. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
A remote unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation leads to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary file inclusion and execution of local files, which could result in server compromise depending on the targeted files and server configuration.
Patchstack has documented this vulnerability in their database for the Greeny WordPress theme version 2.6, providing details on the local file inclusion issue at https://patchstack.com/database/Wordpress/Theme/greeny/vulnerability/wordpress-greeny-theme-2-6-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this advisory for patch availability and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204210
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Greeny greeny allows PHP Local File Inclusion.This issue affects Greeny: from n/a through <= 2.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local file inclusion (LFI) flaw in a public-facing WordPress theme, allowing remote unauthenticated attackers to include and potentially execute arbitrary local files, directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of user-supplied filenames prior to use in PHP include/require statements, directly preventing local file inclusion exploits.
Requires identification, reporting, and timely patching of flaws like the improper filename control in the Greeny theme, eliminating the vulnerability.
Establishes secure PHP configuration settings such as open_basedir restrictions to limit filesystem access and mitigate local file inclusion attempts.