CVE-2025-53441
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Greeny greeny allows PHP Local File Inclusion.This issue affects Greeny: from n/a through <= 2.6.
Mitigating Controls (NIST 800-53 r5)AI
Enforces validation of user-supplied filenames prior to use in PHP include/require statements, directly preventing local file inclusion exploits.
Requires identification, reporting, and timely patching of flaws like the improper filename control in the Greeny theme, eliminating the vulnerability.
Establishes secure PHP configuration settings such as open_basedir restrictions to limit filesystem access and mitigate local file inclusion attempts.
Security SummaryAI
CVE-2025-53441 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Greeny WordPress theme developed by axiomthemes. The issue impacts all versions of Greeny up to and including 2.6, with no lower bound specified. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
A remote unauthenticated attacker (PR:N) can exploit this vulnerability over the network (AV:N) without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation leads to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing arbitrary file inclusion and execution of local files, which could result in server compromise depending on the targeted files and server configuration.
Patchstack has documented this vulnerability in their database for the Greeny WordPress theme version 2.6, providing details on the local file inclusion issue at https://patchstack.com/database/Wordpress/Theme/greeny/vulnerability/wordpress-greeny-theme-2-6-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this advisory for patch availability and mitigation guidance.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local file inclusion (LFI) flaw in a public-facing WordPress theme, allowing remote unauthenticated attackers to include and potentially execute arbitrary local files, directly enabling exploitation of a public-facing application.