CVE-2026-25379: 
WordPress vulnerability analysis and mitigation

CVE-2026-25379 is a PHP Local File Inclusion (LFI) vulnerability in the jwsthemes StreamVid WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all StreamVid versions prior to 6.8.6 and was published on March 25, 2026, with the CVE assigned by Patchstack. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication or user interaction (Feedly, ENISA EUVD).

The root cause is improper control of filenames passed to PHP include/require statements (CWE-98), which allows an attacker to manipulate file path parameters and cause the application to include arbitrary local files from the server. Despite being classified under the 'PHP Remote File Inclusion' CWE, the actual exploitation mechanism in this case is Local File Inclusion (LFI), meaning the attacker can include files already present on the server rather than remote URLs. Exploitation requires no privileges and no user interaction, though the high attack complexity rating suggests that specific conditions or non-default configurations may need to be met (Feedly, ENISA EUVD).

Successful exploitation allows unauthenticated remote attackers to read and include arbitrary files on the server, potentially exposing sensitive data such as credentials, WordPress configuration files (e.g., wp-config.php), and other confidential server-side content. In more severe scenarios, if the attacker can control file content (e.g., via log poisoning or file upload), LFI can escalate to remote code execution, resulting in complete system compromise including data exfiltration, data modification, and service disruption. The vulnerability affects confidentiality, integrity, and availability at a high level (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites using the StreamVid theme (versions < 6.8.6) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source.
2. Identify vulnerable parameter: Locate the theme's file inclusion endpoint or parameter that improperly passes user-controlled input to a PHP include/require statement.
3. Craft LFI payload: Construct a request with a manipulated file path parameter (e.g., ?template=../../../../wp-config.php or similar path traversal sequences) targeting sensitive files on the server.
4. Extract sensitive data: Submit the crafted request and retrieve the contents of included files such as wp-config.php (containing database credentials) or system files like /etc/passwd.
5. Escalate to RCE (optional): If file upload functionality exists or server logs are accessible, inject PHP code into an accessible file and include it via the LFI vector to achieve remote code execution (Feedly, ENISA EUVD).

• Network: Unusual HTTP requests to StreamVid theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting theme files; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server configuration files by the web server process.
• Process: PHP processes reading files outside the WordPress web root or theme directory, particularly system files or credential stores.

The primary remediation is to upgrade the StreamVid WordPress theme to version 6.8.6 or later, which contains the fix for this vulnerability (Feedly, ENISA EUVD). As interim mitigations, administrators should disable PHP's allow_url_include and allow_url_fopen directives in php.ini, deploy a Web Application Firewall (WAF) configured to detect and block path traversal and file inclusion patterns, and apply the principle of least privilege to PHP processes to restrict file system access. Monitor server and WordPress logs for suspicious file inclusion attempts.

The vulnerability was reported and assigned by Patchstack, a WordPress security platform, and was included in Wordfence's weekly WordPress vulnerability report for the week of March 16–22, 2026 (Wordfence). No significant broader media coverage or notable researcher commentary beyond standard vulnerability disclosure channels has been identified.