Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Snow Mountain snowmountain allows PHP Local File Inclusion.This issue affects Snow Mountain: from n/a through <= 1.4.3.
Published: 2026-01-22
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Improper control of the filename used in a PHP include/require statement allows a Local File Inclusion vulnerability in the AncoraThemes Snow Mountain WordPress theme. An attacker can supply crafted input that causes the server to include unintended files, which can lead to disclosure of sensitive configuration files or the execution of arbitrary code. This flaw is classified as a CWE‑98 issue involving the manipulation of include paths.

Affected Systems

AncoraThemes Snow Mountain theme for WordPress, all releases from the initial version through version 1.4.3 are affected.

Risk and Exploitability

The CVSS score is 8.1 and the EPSS score is less than 1%, indicating a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote via web requests that manipulate the filename parameter used in the theme’s include logic. Successful exploitation would require the attacker to be able to influence the include path, which can be achieved through a crafted URL or form input sent to the site.

Generated by OpenCVE AI on April 29, 2026 at 10:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Snow Mountain theme to a version newer than 1.4.3 that fixes the include path handling flaw.
  • If an upgrade is not immediately possible, deactivate or remove the theme to prevent exploitation while a resolution is found.
  • Configure your web server or a web application firewall to detect and block requests that contain directory traversal characters or suspicious parameters targeting the theme’s include logic.

Generated by OpenCVE AI on April 29, 2026 at 10:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Jan 2026 01:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 27 Jan 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Thu, 22 Jan 2026 23:00:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Snow Mountain snowmountain allows PHP Local File Inclusion.This issue affects Snow Mountain: from n/a through <= 1.4.3.
Title WordPress Snow Mountain theme <= 1.4.3 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T20:38:30.650Z

Reserved: 2025-12-29T11:19:06.666Z

Link: CVE-2025-69065

cve-icon Vulnrichment

Updated: 2026-01-27T15:26:52.499Z

cve-icon NVD

Status : Deferred

Published: 2026-01-22T17:16:20.290

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-69065

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-29T10:30:09Z

Weaknesses