CVE-2025-53335: 
WordPress vulnerability analysis and mitigation

CVE-2025-53335 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeREX Berger WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Berger theme up to and including version 1.1.1. The vulnerability was published on March 5, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the ThemeREX Berger theme (CWE-98). An attacker can manipulate file path parameters passed to these inclusion functions to reference arbitrary local files on the server, enabling Local File Inclusion (LFI). Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting specific conditions or non-default configurations must be met. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation allows a network-based attacker to include and execute arbitrary local files on the affected WordPress server without authentication. This can result in unauthorized disclosure of sensitive files (e.g., configuration files containing database credentials), modification of application behavior through execution of attacker-controlled content, and potential full system compromise. All three security pillars are affected: confidentiality, integrity, and availability are each rated High (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term (Feedly, Patchstack).

Update the ThemeREX Berger WordPress theme to a version newer than 1.1.1 as soon as a patched release becomes available. In the interim, consider the following mitigations:

• Disable or restrict web server access to affected theme files via .htaccess or server configuration rules.
• Set allow_url_include = Off in php.ini to prevent remote file inclusion escalation.
• Implement input validation and sanitization for all file inclusion parameters at the application or WAF level.
• Monitor web server and PHP error logs for suspicious file path traversal or inclusion attempts.
• Temporarily deactivate the Berger theme until a patched version is available if risk exposure is unacceptable (Feedly).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of March 2–8, 2026, which aggregates newly disclosed WordPress theme and plugin vulnerabilities (Wordfence). It was also catalogued by VulDB shortly after disclosure. No significant broader media coverage or notable researcher commentary has been identified beyond these routine vulnerability tracking publications.