CVE-2025-60071
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through <= 1.6.23.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the improper filename control in PHP include/require by validating user-supplied inputs to prevent local file inclusion attacks.
Addresses the specific flaw in Riode theme versions through n/a to <=1.6.23 by identifying, reporting, and applying timely remediation such as patching or upgrading.
Enforces secure PHP and web server configuration settings like open_basedir restrictions or disabling allow_url_include to limit exploitation of file inclusion vulnerabilities.
Security SummaryAI
CVE-2025-60071 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, which allows PHP Local File Inclusion in the Riode WordPress theme developed by don-themes. This issue affects Riode versions from n/a through 1.6.23. The vulnerability is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility despite high attack complexity.
Unauthenticated remote attackers (PR:N) can exploit this vulnerability over the network (AV:N) without requiring user interaction (UI:N), though it demands high attack complexity (AC:H). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), such as unauthorized access to local files, potential code execution, or system compromise depending on the included files.
Advisories, including the Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/riode/vulnerability/wordpress-riode-multi-purpose-woocommerce-theme-1-6-23-local-file-inclusion-vulnerability?_s_id=cve, document the vulnerability in the Riode Multi-Purpose WooCommerce Theme version 1.6.23 and provide details relevant to mitigation strategies for affected WordPress installations.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated file inclusion (LFI/RFI) flaw in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for unauthorized file access and potential remote code execution.