Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes OnLeash onleash allows PHP Local File Inclusion.This issue affects OnLeash: from n/a through <= 1.5.2.
Published: 2025-12-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

AncoraThemes OnLeash theme contains an improper control of filename when executing PHP include/require statements. Identified as CWE-98, this flaw allows local file inclusion via PHP. An actor may supply a crafted filename, enabling read access to local files or execution of PHP code if the web server has the necessary permissions.

Affected Systems

All installations of the WordPress OnLeash theme from the earliest release up through version 1.5.2 are affected. Versions 1.5.3 and later have the fix and are not vulnerable.

Risk and Exploitability

The CVSS score of 8.1 signals high severity; the EPSS score of less than 1% indicates a low probability of exploitation in the current landscape. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attack vector involves an attacker supplying a crafted filename via the theme’s interface to trigger the include, potentially revealing sensitive files or executing code.

Generated by OpenCVE AI on April 30, 2026 at 04:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the OnLeash theme to version 1.5.3 or later, which removes the vulnerable logic.
  • If an upgrade is not possible, deactivate or delete the OnLeash theme to eliminate the vulnerability.
  • Review the theme’s code for any remaining dynamic include or require statements and apply input validation or remove them to prevent path traversal or unsanitized inputs.

Generated by OpenCVE AI on April 30, 2026 at 04:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Fri, 19 Dec 2025 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 18 Dec 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 18 Dec 2025 07:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes OnLeash onleash allows PHP Local File Inclusion.This issue affects OnLeash: from n/a through <= 1.5.2.
Title WordPress OnLeash theme <= 1.5.2 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:13:53.803Z

Reserved: 2025-09-25T15:19:32.566Z

Link: CVE-2025-60054

cve-icon Vulnrichment

Updated: 2025-12-18T14:59:42.505Z

cve-icon NVD

Status : Deferred

Published: 2025-12-18T08:16:05.117

Modified: 2026-04-27T16:16:30.667

Link: CVE-2025-60054

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-30T05:00:14Z

Weaknesses