Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.
Published: 2025-09-05
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in the Indutri theme permits an attacker to include local PHP files through improper handling of filenames, which could expose sensitive file contents or potentially execute unintended code when crafted inputs are provided.

Affected Systems

WordPress installations using the Gavias Indutri theme, specifically versions earlier than 1.3.0; all releases affected from the earliest version up to, but not including, 1.3.0.

Risk and Exploitability

The CVSS score of 8.1 indicates high impact, while the EPSS score of less than 1% shows a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves supplying a crafted filename through a web request parameter that is passed to include or require statements within the theme.

Generated by OpenCVE AI on April 30, 2026 at 02:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Indutri theme to version 1.3.0 or later to remove the flaw.
  • If an update cannot be applied immediately, modify the theme’s include logic to validate filenames against a strict whitelist of permitted directories or filenames.
  • As a short‑term safeguard, disable directory browsing on the server and tighten file permissions within the theme’s directory to limit accessible files.
  • Deploy a web application firewall rule or intrusion detection rule that flags attempts to use unusual or relative paths in include parameters.

Generated by OpenCVE AI on April 30, 2026 at 02:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri allows PHP Local File Inclusion. This issue affects Indutri: from n/a through n/a. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sun, 07 Sep 2025 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 05 Sep 2025 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 05 Sep 2025 16:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri allows PHP Local File Inclusion. This issue affects Indutri: from n/a through n/a.
Title WordPress Indutri Theme < 1.3.0 - Local File Inclusion Vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-05-12T00:47:48.363Z

Reserved: 2025-08-27T16:19:19.005Z

Link: CVE-2025-58214

cve-icon Vulnrichment

Updated: 2025-09-05T18:17:23.120Z

cve-icon NVD

Status : Deferred

Published: 2025-09-05T17:15:39.087

Modified: 2026-06-17T09:44:05.070

Link: CVE-2025-58214

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T02:15:25Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')