CVE-2025-64364: 
WordPress vulnerability analysis and mitigation

CVE-2025-64364 is a Local File Inclusion (LFI) vulnerability in the StylemixThemes Masterstudy WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Masterstudy theme prior to 4.8.126 and was reported by researcher João Pedro S Alcântara (Kinorth) on September 30, 2025, with public disclosure on October 31, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), as assessed by CISA-ADP (Patchstack, NVD).

The vulnerability stems from improper validation of user-controlled input used in PHP include/require statements within the Masterstudy theme (CWE-98), enabling PHP Local File Inclusion. An authenticated attacker with at least Contributor-level privileges can manipulate filename parameters to force the server to include arbitrary local files. Exploitation requires network access, low privileges, and high attack complexity, but no user interaction. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database compromise. The high confidentiality, integrity, and availability impact scores reflect the potential for credential theft, data exfiltration, and further lateral movement within the hosting environment. The scope is limited to the affected server, but credential exposure could enable broader infrastructure compromise (Patchstack).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-64364 as of the available data. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the vulnerability class being associated with mass-exploit campaigns (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the Masterstudy theme at versions below 4.8.126 via web fingerprinting tools (e.g., WPScan) or by inspecting theme metadata in publicly accessible style.css files.
2. Obtain low-privilege access: Register or obtain a Contributor or Developer-level account on the target WordPress site, as the vulnerability requires at least Contributor privileges.
3. Identify vulnerable parameter: Locate the theme functionality that accepts a filename or path parameter used in a PHP include/require statement — typically found in theme template loading or shortcode handlers.
4. Craft LFI payload: Submit a crafted request with a path traversal sequence (e.g., ../../../../wp-config.php) in the vulnerable filename parameter to force inclusion of a sensitive local file.
5. Extract sensitive data: Review the server response for the contents of the included file, such as database credentials from wp-config.php, which can then be used for further attacks (Patchstack).

• Logs: WordPress access logs showing requests with path traversal sequences (e.g., ../, %2e%2e%2f) in theme-related parameters; PHP error logs referencing unexpected file inclusion paths.
• Network: Unusual outbound connections from the web server following theme interaction, potentially indicating post-exploitation activity.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or /etc/passwd correlating with suspicious web requests.
• Process: PHP processes reading files outside the WordPress web root directory, observable via server-side monitoring or audit logging tools.

The primary remediation is to update the Masterstudy WordPress theme to version 4.8.126 or later, which contains the fix for this vulnerability. Site administrators unable to update immediately should restrict Contributor-level user registration and review user roles to minimize the attack surface. Hosting providers or web developers should be consulted if an immediate update is not feasible (Patchstack).

Wordfence included CVE-2025-64364 in its weekly WordPress vulnerability report covering October 27 – November 2, 2025, noting it as part of the broader landscape of WordPress theme vulnerabilities. Patchstack, which discovered and disclosed the vulnerability, classifies it as low priority with limited exploitation likelihood. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.