CVE-2026-25464: 
WordPress vulnerability analysis and mitigation

CVE-2026-25464 is a Local File Inclusion (LFI) vulnerability in the TieLabs Jannah WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Jannah theme up to and including 7.6.3, and was published on March 25, 2026, with Patchstack credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper validation and sanitization of filename parameters passed to PHP include/require statements within the Jannah theme (CWE-98). An unauthenticated remote attacker can manipulate file path parameters in HTTP requests to cause the server to include arbitrary local PHP files, potentially executing their contents. The attack vector is network-based, requires no privileges or user interaction, but has high attack complexity, suggesting some precondition or bypass is needed to successfully exploit the flaw. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation could allow an attacker to include and execute arbitrary local PHP files on the web server, leading to unauthorized disclosure of sensitive files (e.g., WordPress configuration files containing database credentials), arbitrary code execution, and full compromise of the web application and underlying server. The vulnerability has high impact on confidentiality, integrity, and availability, and could serve as a stepping stone for lateral movement within a hosting environment (Feedly).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity rating further reduces the immediate risk of widespread exploitation (Feedly).

Users should upgrade the TieLabs Jannah WordPress theme to a version higher than 7.6.3 as soon as a patched release becomes available. In the interim, implement input validation and sanitization for all file inclusion parameters, and consider deploying a Web Application Firewall (WAF) to detect and block local file inclusion attempts. Restrict PHP's include/require functionality where possible and enforce strict access controls on sensitive server files such as wp-config.php (Feedly, Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering March 16–22, 2026, indicating routine tracking by the WordPress security community. No significant vendor statements, researcher commentary, or broader media coverage have been identified beyond standard vulnerability database listings (Wordfence).