CVE-2025-67525

WordPress ekommart theme < 4.3.1 - Local File Inclusion vulnerability

View on CVE.org
Published Dec 9, 2025 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opal_WP ekommart ekommart allows PHP Local File Inclusion.This issue affects ekommart: from n/a through < 4.3.1.

Analysis

AI-generated

Technical impact

Improper control of filenames in the ekommart WordPress theme creates a Local File Inclusion vulnerability. By manipulating the include/require statement, an attacker can read arbitrary files from the web server, potentially exposing sensitive configuration data or executing code if a malicious PHP file is included.

Affected Systems

WordPress sites running the ekommart theme before version 4.3.1 are affected. The vulnerability applies to all Opal_WP ekommart installs that have not upgraded past 4.3.1.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity issue, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The flaw is a Local File Inclusion; exploitation would require the attacker to supply a file path that the application processes, but no public exploit remains documented.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the ekommart theme to version 4.3.1 or newer, which removes the vulnerable include logic.
  • If an upgrade is infeasible, restrict file permissions for the WordPress upload directory and remove any writable directories that can be targeted by the include path.
  • Deploy a web application firewall rule to block requests with directory traversal characters or suspicious include parameters.
  • Implement a whitelist of allowed files for include/require statements within custom code to prevent future inclusion of unintended files.

Generated by OpenCVE AI on April 29, 2026 at 19:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opal_WP ekommart ekommart allows PHP Local File Inclusion.This issue affects ekommart: from n/a through < 4.3.1.
Title WordPress ekommart theme < 4.3.1 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Earlier changes (2)
Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:14 PM
Reserved
Dec 9, 2025, 12:21 PM

View source JSON

Updated
Dec 11, 2025, 6:59 PM

JSON

Status
Deferred
Published
Dec 9, 2025, 4:18 PM
Modified
Oct 23, 2026, 10:10 PM

View source JSON

No data.

Updated
Apr 29, 2026, 7:45 PM

JSON