CVE-2026-25380: 
WordPress vulnerability analysis and mitigation

CVE-2026-25380 is a PHP Local File Inclusion (LFI) vulnerability in the jwsthemes Feedy WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all Feedy theme versions prior to 2.1.5 and was published on March 25, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), reflecting a network-accessible, unauthenticated attack with no user interaction required (Feedly, Patchstack).

The root cause is improper validation of filenames passed to PHP include/require statements within the Feedy theme (CWE-98), allowing an attacker to manipulate the file path parameter to include arbitrary local files from the server. Because no authentication or user interaction is required, a remote attacker can craft a malicious HTTP request targeting the vulnerable include logic. The attack complexity is rated High, suggesting some conditions or knowledge of the target environment may be needed to successfully exploit the flaw. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation could allow an unauthenticated remote attacker to read sensitive files from the server (e.g., configuration files containing credentials), execute arbitrary PHP code with web server privileges, modify or delete application data, and potentially cause service disruption — all resulting in high confidentiality, integrity, and availability impacts. In a WordPress context, this could expose database credentials from wp-config.php, enabling further lateral movement or full site takeover (Feedly).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2026-25380. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, Patchstack).

The primary remediation is to update the Feedy WordPress theme to version 2.1.5 or later, which contains the fix for this vulnerability. For sites that cannot be patched immediately, administrators should implement network-level access controls to restrict external access to the affected WordPress installation and monitor web server logs for suspicious file inclusion attempts (e.g., requests with path traversal sequences or unexpected file path parameters). Disabling the theme until patching is feasible is also a viable interim measure (Feedly, Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of March 16–22, 2026, and tracked by VulDB. No significant broader media coverage or notable researcher commentary has been identified beyond standard vulnerability database entries (Wordfence, VulDB).