CVE-2026-25379
Published: 25 March 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes StreamVid streamvid allows PHP Local File Inclusion.This issue affects StreamVid: from n/a through < 6.8.6.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the specific PHP file inclusion flaw in StreamVid versions prior to 6.8.6.
Mandates validation of untrusted filename inputs to PHP include/require statements, directly preventing local file inclusion exploitation.
Establishes secure baseline PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit paths exploitable in LFI attacks.
Security SummaryAI
CVE-2026-25379 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, affecting the StreamVid WordPress theme developed by jwsthemes. The flaw enables PHP Local File Inclusion and impacts all versions of StreamVid from its initial release through versions prior to 6.8.6. Published on 2026-03-25, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-98.
Unauthenticated attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing remote code execution or arbitrary file access via local file inclusion on the targeted WordPress site running the vulnerable theme.
The Patchstack advisory for this vulnerability, accessible at the provided reference URL, indicates that the issue is fixed in StreamVid version 6.8.6. Security practitioners should urge site administrators to update the theme to 6.8.6 or later to mitigate the risk, alongside standard WordPress hardening practices such as restricting file permissions and monitoring for suspicious include operations.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme directly enables exploitation of public-facing application (T1190) for local file access and potential RCE.