CVE-2025-52810

WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion Vulnerability

View on CVE.org
Published Jun 27, 2025 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.

Analysis

AI-generated

Technical impact

A path traversal flaw in the Katerio - Magazine WordPress theme permits local file inclusion; the vulnerability can enable an attacker to read arbitrary files on the server and potentially execute code, thereby compromising confidentiality, integrity, and availability of the website.

Affected Systems

The issue affects the Katerio - Magazine theme from the earliest releases through version 1.5.1, supplied by TMRW‑studio.

Risk and Exploitability

The CVSS score of 8.1 reflects significant risk, and although the EPSS score is below 1%, exploitation is still plausible because the vulnerability is a local file inclusion that can be triggered by crafted HTTP requests. The CVE is not listed in CISA's KEV catalog. Attackers can exploit this weakness by supplying a malicious file path to the vulnerable theme code, then reading sensitive files or executing arbitrary PHP code if the server environment permits.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Katerio - Magazine theme to a version newer than 1.5.1 where the path traversal issue has been fixed.
  • Configure the web server or PHP to restrict file access for the WordPress installation, for example by applying an open_basedir setting that excludes directories outside the site root.
  • Monitor the web server and application logs for attempts to include files and add a firewall rule that blocks path traversal sequences such as ../ .

Generated by OpenCVE AI on April 30, 2026 at 10:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-19305 Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
History
Type Values Removed Values Added
Description Path Traversal: '.../...//' vulnerability in TMRW-studio Katerio - Magazine katerio allows PHP Local File Inclusion.This issue affects Katerio - Magazine: from n/a through <= 1.5.1. Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
References
Type Values Removed Values Added
Description Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1. Path Traversal: '.../...//' vulnerability in TMRW-studio Katerio - Magazine katerio allows PHP Local File Inclusion.This issue affects Katerio - Magazine: from n/a through <= 1.5.1.
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.
Title WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion Vulnerability
Weaknesses CWE-35
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (1)
Weaknesses
  • CWE-35

    Path Traversal: '.../...//'

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:13 PM
Reserved
Jun 19, 2025, 10:03 AM

View source JSON

Updated
Jun 27, 2025, 2:38 PM

JSON

Status
Deferred
Published
Jun 27, 2025, 12:15 PM
Modified
Jun 17, 2026, 9:37 AM

View source JSON

No data.

Updated
Apr 30, 2026, 10:45 AM

JSON