CVE-2025-53440

Vulnerability

An Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, exists in Axiomthemes Confidant theme. This vulnerability allows for PHP Local File Inclusion. The issue affects Confidant versions from n/a through 1.4 [1].

Exploitation

An attacker can exploit this vulnerability by including local files of the target website. The exact steps required for exploitation are not detailed in the available references, but it is expected to be used in mass-exploit campaigns [1].

Impact

Successful exploitation allows a malicious actor to include local files of the target website and display their content. This could lead to the disclosure of sensitive information, such as database credentials, potentially enabling a complete database takeover depending on the server's configuration [1].

Mitigation

Users should update the affected plugin to a version later than 1.4. If updating is not immediately possible, users are advised to seek assistance from their hosting provider or web developer. The specific fixed version and release date are not yet disclosed in the available references [1].