Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Fribbo fribbo allows PHP Local File Inclusion.This issue affects Fribbo: from n/a through <= 1.1.0.
Published: 2025-12-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper control of filename for an include/require statement in PHP, leading to local file inclusion in the Fribbo theme. This flaw allows an attacker to specify a path to include arbitrary local files or potentially execute code, compromising the confidentiality, integrity, or availability of the underlying web application. The weakness is classified as CWE‑98.

Affected Systems

AncoraThemes Fribbo theme for WordPress, versions up to and including 1.1.0, is impacted. Any WordPress site running that theme installation is vulnerable.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Because the flaw involves local file inclusion, the attack likely requires some form of authenticated or local access, but if the theme processes user‑supplied input, remote exploitation might be possible. The vulnerability is not listed in CISA’s KEV catalog, so no known active exploitation has been reported. However, the high impact warrants prompt mitigation.

Generated by OpenCVE AI on April 29, 2026 at 22:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Fribbo theme to a version newer than 1.1.0 that removes the vulnerable include logic.
  • If an upgraded theme is not available, uninstall or disable the Fribbo theme and replace it with a secure alternative.
  • Ensure that any custom or third‑party code invoking PHP include/require statements validates the path against a trusted list and does not accept untrusted input—this mitigates the CWE‑98 weakness.

Generated by OpenCVE AI on April 29, 2026 at 22:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Fri, 19 Dec 2025 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 18 Dec 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 18 Dec 2025 07:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Fribbo fribbo allows PHP Local File Inclusion.This issue affects Fribbo: from n/a through <= 1.1.0.
Title WordPress Fribbo theme <= 1.1.0 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:53.270Z

Reserved: 2025-09-25T15:19:17.077Z

Link: CVE-2025-60044

cve-icon Vulnrichment

Updated: 2025-12-18T16:34:39.298Z

cve-icon NVD

Status : Deferred

Published: 2025-12-18T08:16:03.820

Modified: 2026-04-27T16:16:29.613

Link: CVE-2025-60044

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T22:30:21Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')