Cyber Posture

CVE-2025-22509

High

Published: 08 January 2026

Published
08 January 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 17.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Security Summary

CVE-2025-22509 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that enables PHP Local File Inclusion in the TMRW-studio Atlas WordPress theme. This flaw, tied to CWE-98, affects Atlas versions from n/a through 2.1.0 and was published on 2026-01-08.

The vulnerability can be exploited by unauthenticated attackers (PR:N) over the network (AV:N) without requiring user interaction (UI:N), though it demands high attack complexity (AC:H) and results in unchanged scope (S:U). Successful exploitation yields high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), earning a CVSS v3.1 base score of 8.1 and potentially allowing attackers to read or include arbitrary local files, leading to information disclosure or code execution.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/atlas/vulnerability/wordpress-atlas-theme-2-1-0-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion issue in the WordPress Atlas theme version 2.1.0, including mitigation guidance for affected deployments.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
Why these techniques?

LFI in public-facing WordPress theme enables unauthenticated remote exploitation (T1190) and arbitrary local file reads for sensitive data disclosure (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References