Cyber Posture

CVE-2025-53439

High

Published: 18 December 2025

Published
18 December 2025
Modified
20 January 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Harper harper allows PHP Local File Inclusion.This issue affects Harper: from n/a through <= 1.13.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the inadequate validation of filenames in PHP include/require statements, preventing local file inclusion by enforcing input validation mechanisms.

SI-2 Flaw Remediation good match
prevent

Remediates the specific flaw in Harper WordPress theme versions through 1.13 by identifying, patching, and correcting the PHP local file inclusion vulnerability.

CM-6 Configuration Settings partial match
prevent

Enforces secure PHP configuration settings like open_basedir restrictions to limit accessible file paths, mitigating LFI even if filename validation is bypassed.

Security SummaryAI

CVE-2025-53439 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98, that enables PHP Local File Inclusion in the Harper WordPress theme developed by axiomthemes. This issue affects Harper versions from n/a through 1.13 inclusive. The vulnerability stems from inadequate validation of filenames used in PHP include/require statements, allowing malicious input to reference local files.

A remote, unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation within an unchanged scope (S:U) grants high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), potentially enabling attackers to read sensitive local files, execute arbitrary code if combined with other flaws, or disrupt theme functionality. The CVSS v3.1 base score is 8.1.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/harper/vulnerability/wordpress-harper-theme-1-13-local-file-inclusion-vulnerability?_s_id=cve documents the Local File Inclusion vulnerability specifically in Harper theme version 1.13, providing details relevant to mitigation for WordPress users.

Details

CWE(s)
CWE-98

Affected Products

axiomthemes
harper
≤ 1.13

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

LFI in public-facing WordPress theme enables T1190 (exploit public-facing application) for initial access and T1005 (data from local system) by allowing remote reading of sensitive local files.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References