Cyber Posture

CVE-2025-60050

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Panda panda allows PHP Local File Inclusion.This issue affects Panda: from n/a through <= 1.21.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by requiring timely patching of the vulnerable Panda WordPress theme to versions beyond 1.21.

SI-10 Information Input Validation good match
prevent

Requires validation of filenames and paths in PHP include/require statements to block malicious local file inclusion inputs.

CM-6 Configuration Settings partial match
prevent

Enforces secure PHP configuration settings such as open_basedir restrictions to limit the scope of file inclusion even if flawed code exists.

Security SummaryAI

CVE-2025-60050 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that allows PHP Local File Inclusion in the Panda WordPress theme developed by axiomthemes. This issue affects Panda versions from n/a through 1.21 and was published on 2025-12-18. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Remote, unauthenticated attackers can exploit this vulnerability over the network with high attack complexity and without requiring user interaction. Successful exploitation enables local file inclusion, potentially leading to high impacts on confidentiality, integrity, and availability, such as unauthorized access to sensitive files or system compromise.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/panda/vulnerability/wordpress-panda-theme-1-21-local-file-inclusion-vulnerability?_s_id=cve) documents this Local File Inclusion vulnerability specifically in WordPress Panda theme version 1.21.

Details

CWE(s)
CWE-98

Affected Products

axiomthemes
panda
≤ 1.21

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress theme allows remote unauthenticated LFI, mapping to T1190 (Exploit Public-Facing Application) for initial exploitation and T1083 (File and Directory Discovery) via arbitrary local file access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References