CVE-2025-64223

CVE-2025-64223 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, in the PenciDesign PenNews WordPress theme. The vulnerability affects PenNews versions from n/a through those prior to 6.7.3 and is associated with CWE-98. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential network-based exploitation with significant impacts.

A remote, unauthenticated attacker can exploit this vulnerability over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks could result in high confidentiality, integrity, and availability impacts, potentially allowing the inclusion and execution of local PHP files, leading to unauthorized access, data disclosure, modification, or system disruption on affected WordPress sites using the vulnerable theme.

The Patchstack advisory details this Local File Inclusion vulnerability in the PenNews WordPress theme and confirms it is resolved in version 6.7.3. Mitigation involves updating to PenNews 6.7.3 or later to address the improper filename control in PHP include/require statements.