CVE-2026-25379
Published: 25 March 2026
Summary
CVE-2026-25379 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-25379 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, affecting the StreamVid WordPress theme developed by jwsthemes. The flaw enables PHP Local File Inclusion and impacts all versions of StreamVid from its initial release through versions prior to 6.8.6. Published on 2026-03-25, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-98.
Unauthenticated attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing remote code execution or arbitrary file access via local file inclusion on the targeted WordPress site running the vulnerable theme.
The Patchstack advisory for this vulnerability, accessible at the provided reference URL, indicates that the issue is fixed in StreamVid version 6.8.6. Security practitioners should urge site administrators to update the theme to 6.8.6 or later to mitigate the risk, alongside standard WordPress hardening practices such as restricting file permissions and monitoring for suspicious include operations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15696
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through < 6.8.6.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme directly enables exploitation of public-facing application (T1190) for local file access and potential RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the specific PHP file inclusion flaw in StreamVid versions prior to 6.8.6.
Mandates validation of untrusted filename inputs to PHP include/require statements, directly preventing local file inclusion exploitation.
Establishes secure baseline PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit paths exploitable in LFI attacks.