Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through <= 4.4.7.
Published: 2025-12-16
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Inclusion
Action: Apply Patch
AI Analysis

Impact

This vulnerability resides in ThemeMove EduMall theme and permits a local file inclusion due to improper control of filenames in the include/require statements. The flaw is identified as CWE‑98 and can potentially lead to disclosure of server-side files and may enable the execution of arbitrary code if the attacker can influence the included file.

Affected Systems

WordPress installations that use ThemeMove EduMall versions 4.4.7 and earlier are affected. No other vendors or products are listed as impacted by this issue.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is less than 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, and based on the description, it is inferred that the attack vector is local, requiring the ability to influence the file inclusion path, typically through administrative or theme code access.

Generated by OpenCVE AI on April 27, 2026 at 22:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade EduMall to a patched version (4.4.8 or later).
  • Disable or remove legacy include functionality that accepts user-controlled filenames.
  • Implement input sanitization to ensure that only trusted paths are used in include/require statements.

Generated by OpenCVE AI on April 27, 2026 at 22:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Apr 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Thu, 29 Jan 2026 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Thememove
Thememove edumall
CPEs cpe:2.3:a:thememove:edumall:*:*:*:*:*:wordpress:*:*
Vendors & Products Thememove
Thememove edumall

Tue, 20 Jan 2026 15:30:00 +0000

Type Values Removed Values Added
References

Tue, 20 Jan 2026 14:45:00 +0000

Type Values Removed Values Added
References

Tue, 16 Dec 2025 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 16 Dec 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 16 Dec 2025 08:30:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through <= 4.4.7.
Title WordPress EduMall theme <= 4.4.7 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Thememove Edumall
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:14:28.030Z

Reserved: 2025-12-15T10:01:19.543Z

Link: CVE-2025-68061

cve-icon Vulnrichment

Updated: 2025-12-16T15:32:00.683Z

cve-icon NVD

Status : Modified

Published: 2025-12-16T09:16:01.477

Modified: 2026-04-27T19:16:24.283

Link: CVE-2025-68061

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-27T22:30:14Z

Weaknesses