Cyber Posture

CVE-2025-64205

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local File Inclusion.This issue affects Jannah: from n/a through <= 7.6.0.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 directly mitigates the improper filename control in PHP include/require by enforcing validation of user-supplied inputs to prevent local file inclusion.

SI-2 Flaw Remediation good match
prevent

SI-2 addresses the CVE by requiring timely identification, reporting, and patching of the specific flaw in Jannah theme versions through 7.6.0.

CM-6 Configuration Settings partial match
prevent

CM-6 mitigates exploitation by enforcing secure PHP configuration settings such as open_basedir restrictions and disabling allow_url_include to limit file access paths.

Security SummaryAI

CVE-2025-64205 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the TieLabs Jannah WordPress theme. This issue affects Jannah versions from n/a through 7.6.0 and is associated with CWE-98. The vulnerability was published on 2025-12-18 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.

Unauthenticated attackers can exploit this vulnerability over the network without requiring user interaction, though it demands high attack complexity. Successful exploitation allows local file inclusion, potentially granting attackers high-level access to read sensitive files, modify data, or disrupt availability on the affected WordPress site running the vulnerable Jannah theme.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/jannah/vulnerability/wordpress-jannah-theme-7-6-0-local-file-inclusion-vulnerability?_s_id=cve documents this local file inclusion vulnerability in the Jannah theme version 7.6.0, providing details relevant for mitigation in WordPress environments.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of a public-facing WordPress theme via improper filename control leading to LFI (T1190), directly facilitating arbitrary local file reads for data collection (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References