Cyber Posture

CVE-2025-48290

High

Published: 06 November 2025

Published
06 November 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Security Summary

CVE-2025-48290 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98), affecting the Kinsley WordPress theme developed by bslthemes. This flaw impacts Kinsley versions from n/a through 3.4.4 and was published on 2025-11-06.

The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation by unauthenticated attackers over the network with high attack complexity and no user interaction. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially enabling local file disclosure or manipulation through improper handling of include/require statements.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/kinsley/vulnerability/wordpress-kinsley-theme-3-4-4-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

Public-facing WordPress theme vulnerability enables unauthenticated remote exploitation (T1190). LFI allows arbitrary local file inclusion, facilitating data collection from local system (T1005) and file/directory discovery (T1083).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References