CVE-2025-47474
Published: 22 January 2026
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-47474 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Ninetheme Anarkali WordPress theme. This issue affects Anarkali versions from n/a through 1.0.9. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-98.
A remote, unauthenticated attacker can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, such as arbitrary local file inclusion potentially leading to sensitive data exposure, file modification, or denial of service.
The Patchstack advisory provides details on this Local File Inclusion vulnerability in the WordPress Anarkali theme version 1.0.9, including mitigation guidance, available at https://patchstack.com/database/Wordpress/Theme/anarkali/vulnerability/wordpress-anarkali-theme-1-0-9-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a critical unauthenticated LFI in a public-facing WordPress theme, directly enabling exploitation of public-facing applications via improper filename control in PHP include/require.