CVE-2025-53432
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Echo echo allows PHP Local File Inclusion.This issue affects Echo: from n/a through <= 1.15.0.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of untrusted inputs such as filenames in PHP include/require statements, directly preventing exploitation of this improper filename control vulnerability leading to local file inclusion.
SI-2 mandates timely flaw remediation, directly addressing this specific LFI vulnerability in the Echo WordPress theme by applying patches for affected versions <=1.15.0.
SC-7 provides boundary protection via web application firewalls or proxies that filter and block malicious file inclusion payloads targeting this PHP vulnerability.
Security SummaryAI
CVE-2025-53432 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Echo WordPress theme developed by AncoraThemes. This issue affects Echo versions from n/a through 1.15.0. Published on 2025-12-18T08:15:53.440, it carries a CVSS v3.1 base score of 8.1 (High) with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H and is associated with CWE-98.
A remote attacker with no privileges can exploit this vulnerability over the network, requiring high attack complexity but no user interaction. Exploitation allows high-impact outcomes on confidentiality, integrity, and availability, such as unauthorized access to local files or potential code execution via inclusion of local PHP files.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/echo/vulnerability/wordpress-echo-theme-1-15-0-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application via unauthenticated remote access.