Cyber Posture

CVE-2025-53432

High

Published: 18 December 2025

Published
18 December 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Echo echo allows PHP Local File Inclusion.This issue affects Echo: from n/a through <= 1.15.0.

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 requires validation of untrusted inputs such as filenames in PHP include/require statements, directly preventing exploitation of this improper filename control vulnerability leading to local file inclusion.

prevent

SI-2 mandates timely flaw remediation, directly addressing this specific LFI vulnerability in the Echo WordPress theme by applying patches for affected versions <=1.15.0.

preventdetect

SC-7 provides boundary protection via web application firewalls or proxies that filter and block malicious file inclusion payloads targeting this PHP vulnerability.

Security SummaryAI

CVE-2025-53432 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Echo WordPress theme developed by AncoraThemes. This issue affects Echo versions from n/a through 1.15.0. Published on 2025-12-18T08:15:53.440, it carries a CVSS v3.1 base score of 8.1 (High) with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and is associated with CWE-98.

A remote attacker with no privileges can exploit this vulnerability over the network, requiring high attack complexity but no user interaction. Exploitation allows high-impact outcomes on confidentiality, integrity, and availability, such as unauthorized access to local files or potential code execution via inclusion of local PHP files.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/echo/vulnerability/wordpress-echo-theme-1-15-0-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application via unauthenticated remote access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References