CVE-2025-53437CWE-98

WordPress Greenorganic theme <= 2.45 - Local File Inclusion vulnerability

High · published December 18, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
41.8
In the wild
Unconfirmed
What it is

⚡ PHP Local File Inclusion just got a little too cozy! An improperly controlled filename in ApusTheme Greenorganic could let attackers sneak their way into your server environment. 💻 Think of it like a hotel concierge who doesn't check IDs before handing out room keys. Anyone could walk in and access sensitive areas if they know how to ask! An attacker could potentially include unauthorized files, which means they could read or manipulate sensitive data on your server. This could lead to complete system compromise, allowing the attacker to wreak havoc on your application and data. Absolutely devastating!

Put simply

Think of it like a hotel concierge who doesn't check IDs before handing out room keys. Anyone could walk in and access sensitive areas if they know how to ask! This vulnerability in ApusTheme Greenorganic allows for PHP Local File Inclusion due to insufficient checks on file paths. This means that if an attacker can control the input for file inclusion, they can potentially load unauthorized files from the server.

What to do

An attacker could potentially include unauthorized files, which means they could read or manipulate sensitive data on your server. This could lead to complete system compromise, allowing the attacker to wreak havoc on your application and data. Absolutely devastating! Update ApusTheme Greenorganic to version 2.46 or later to patch this vulnerability. Implement strict input validation to ensure that only legitimate filenames are processed. Regular security audits of your code can further ensure your defenses are up to par! You've got this! Follow these steps to secure your application and enjoy peace of mind. 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.8th percentile
Weakness
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published
2025-12-18T07:21Z
EPSS history
Timeline
  • 18 DEC 07:21Z
    WordPress Greenorganic theme <= 2.45 - Local File Inclusion vulnerability
    cvelistv5