CVE-2025-64195: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-64195) was discovered in ThimPress's Eduma WordPress theme, affecting versions through 5.7.6. The vulnerability was disclosed on October 29, 2025, and is classified as an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability is network-accessible, requires high attack complexity, needs low privileges, requires no user interaction, and has high impacts on confidentiality, integrity, and availability (CISA-ADP).

The vulnerability could potentially lead to unauthorized access to local files on the affected system, compromising the confidentiality, integrity, and availability of the system. The high CVSS impact scores (C:H/I:H/A:H) indicate severe potential consequences if successfully exploited (NVD).

Users running Eduma WordPress theme versions 5.7.6 or earlier should upgrade to a patched version when available. No specific workarounds have been publicly documented (Patchstack).