Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yokoo yokoo allows PHP Local File Inclusion.This issue affects Yokoo: from n/a through <= 1.1.11.
Published: 2026-02-20
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Local File Inclusion
Action: Immediate Patch
AI Analysis

Impact

The flaw stems from an improper control of filenames used in PHP include/require statements within the WordPress Yokoo theme. This defect allows an attacker to include arbitrary local files on the server. While the vulnerability is classified as a Local File Inclusion, reading sensitive files can expose confidential information, and if a malicious file can be placed in a readable location, it may enable code execution.

Affected Systems

WordPress sites that run the ThemeREX Yokoo theme, version 1.1.11 or earlier. The issue is confined to the theme itself and is not specific to particular WordPress core versions or hosting environments.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity, but the EPSS score is below 1%, suggesting a low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve manipulating query parameters, form inputs, or other user‑controlled data that the theme forwards to an include/require call to trigger the inclusion of local files.

Generated by OpenCVE AI on April 28, 2026 at 09:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Yokoo theme to a non‑vulnerable release (≥ 1.1.12 if available).
  • Disable PHP's allow_url_include directive and enforce restrictive file permissions so that only intended files are readable by the web process.
  • Audit theme code for dynamic file includes and replace any path logic with a strict whitelist or remove the calls entirely.

Generated by OpenCVE AI on April 28, 2026 at 09:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Feb 2026 06:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 24 Feb 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Mon, 23 Feb 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Themerex
Themerex yokoo
Wordpress
Wordpress wordpress
Vendors & Products Themerex
Themerex yokoo
Wordpress
Wordpress wordpress

Fri, 20 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Yokoo yokoo allows PHP Local File Inclusion.This issue affects Yokoo: from n/a through <= 1.1.11.
Title WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerability
Weaknesses CWE-98
References

Subscriptions

Themerex Yokoo
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T21:00:12.779Z

Reserved: 2025-12-31T20:13:16.055Z

Link: CVE-2025-69400

cve-icon Vulnrichment

Updated: 2026-02-24T20:31:52.748Z

cve-icon NVD

Status : Deferred

Published: 2026-02-20T16:22:25.767

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-69400

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-28T09:30:26Z

Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')