CVE-2025-62055
Published: 06 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-62055 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion (CWE-98), in the Elated-Themes Academist WordPress theme. This issue affects Academist versions from n/a through those prior to 1.3. The vulnerability was published on 2025-11-06 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, such as potential remote code execution or arbitrary file inclusion depending on server configuration.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/academist/vulnerability/wordpress-academist-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve details mitigation, recommending an update to Academist version 1.3 or later to address the vulnerability.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an unauthenticated remote file inclusion flaw in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application for initial access and potential RCE.