CVE-2025-50003: 
WordPress vulnerability analysis and mitigation

CVE-2025-50003 is a PHP Local File Inclusion (LFI) vulnerability in the Amuli WordPress theme developed by Axiomthemes. It stems from improper control of filenames in PHP include/require statements (CWE-98), allowing unauthenticated network attackers to include arbitrary local PHP files. All versions of the Amuli theme through 2.3.0 are affected. The vulnerability was published on January 22, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High), as scored by Patchstack (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Amuli theme fails to properly sanitize or validate user-supplied input used in PHP include or require statements, enabling an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires no authentication and no user interaction, but is rated as high complexity (AC:H), suggesting that specific conditions or non-default configurations may need to be met. The attack vector is network-based, meaning exploitation can be attempted remotely (Patchstack).

Successful exploitation of this vulnerability can result in high impact to confidentiality, integrity, and availability of the affected WordPress installation. An attacker could read sensitive local files (e.g., WordPress configuration files containing database credentials), execute arbitrary PHP code if writable directories or uploaded files are leveraged, and potentially achieve full server compromise. This could further enable lateral movement within the hosting environment or exposure of sensitive user and application data (Patchstack).

As of the time of reporting, no public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation. The vulnerability has an EPSS score of approximately 0.053%, indicating a low current probability of exploitation. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity rating suggests exploitation is non-trivial, though the lack of authentication requirements lowers the barrier for motivated attackers (Patchstack).

No patch is currently available for the Amuli theme from Axiomthemes. Recommended mitigations include:

• Disable or remove the Amuli theme from affected WordPress installations until a patched version is released.
• Deploy WAF rules to detect and block suspicious file inclusion attempts targeting WordPress theme parameters.
• Restrict network access to WordPress admin interfaces and limit exposure of the affected installations.
• Monitor access logs for unusual requests containing path traversal sequences (e.g., ../, %2e%2e%2f) or references to sensitive files.
• Contact the vendor (Axiomthemes) directly to request a security update or timeline for a patch.
• Consider replacing the theme with an actively maintained alternative if the vendor does not provide timely remediation (Patchstack).

The vulnerability was reported by Patchstack and noted in Wordfence's weekly WordPress vulnerability report for the week of January 5–11, 2026. No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified (Wordfence Blog).