Cyber Posture

CVE-2025-14431

High

Published: 08 January 2026

Published
08 January 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Requires timely patching or updating of the vulnerable Navian WordPress theme to remediate the PHP Local File Inclusion flaw affecting versions through 1.5.4.

prevent

Mandates validation of untrusted filename inputs to PHP include/require statements, directly preventing malicious local file inclusion paths.

prevent

Enforces secure PHP configuration settings like open_basedir restrictions or disabling URL-aware file functions to mitigate file inclusion vulnerabilities.

Security SummaryAI

CVE-2025-14431 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion (CWE-98), in the THEMELOGI Navian WordPress theme. The flaw enables PHP Local File Inclusion and affects all versions of Navian from n/a through 1.5.4. Published on 2026-01-08, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited remotely by unauthenticated attackers over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially enabling local file inclusion to read sensitive files or execute arbitrary code on the server.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/navian/vulnerability/wordpress-navian-theme-1-5-4-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a critical unauthenticated remote file inclusion flaw in a public-facing WordPress theme, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References