CVE-2025-64205
Published: 18 December 2025
Summary
CVE-2025-64205 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-64205 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the TieLabs Jannah WordPress theme. This issue affects Jannah versions from n/a through 7.6.0 and is associated with CWE-98. The vulnerability was published on 2025-12-18 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.
Unauthenticated attackers can exploit this vulnerability over the network without requiring user interaction, though it demands high attack complexity. Successful exploitation allows local file inclusion, potentially granting attackers high-level access to read sensitive files, modify data, or disrupt availability on the affected WordPress site running the vulnerable Jannah theme.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/jannah/vulnerability/wordpress-jannah-theme-7-6-0-local-file-inclusion-vulnerability?_s_id=cve documents this local file inclusion vulnerability in the Jannah theme version 7.6.0, providing details relevant for mitigation in WordPress environments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204085
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables exploitation of a public-facing WordPress theme via improper filename control leading to LFI (T1190), directly facilitating arbitrary local file reads for data collection (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly mitigates the improper filename control in PHP include/require by enforcing validation of user-supplied inputs to prevent local file inclusion.
SI-2 addresses the CVE by requiring timely identification, reporting, and patching of the specific flaw in Jannah theme versions through 7.6.0.
CM-6 mitigates exploitation by enforcing secure PHP configuration settings such as open_basedir restrictions and disabling allow_url_include to limit file access paths.