CVE-2025-14431
Published: 08 January 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching or updating of the vulnerable Navian WordPress theme to remediate the PHP Local File Inclusion flaw affecting versions through 1.5.4.
Mandates validation of untrusted filename inputs to PHP include/require statements, directly preventing malicious local file inclusion paths.
Enforces secure PHP configuration settings like open_basedir restrictions or disabling URL-aware file functions to mitigate file inclusion vulnerabilities.
Security SummaryAI
CVE-2025-14431 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion (CWE-98), in the THEMELOGI Navian WordPress theme. The flaw enables PHP Local File Inclusion and affects all versions of Navian from n/a through 1.5.4. Published on 2026-01-08, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited remotely by unauthenticated attackers over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially enabling local file inclusion to read sensitive files or execute arbitrary code on the server.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/navian/vulnerability/wordpress-navian-theme-1-5-4-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a critical unauthenticated remote file inclusion flaw in a public-facing WordPress theme, directly enabling exploitation of a public-facing application.