CVE-2025-2101

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-2101", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-03-07T18:42:57.689Z", "datePublished": "2025-04-26T08:23:20.508Z", "dateUpdated": "2026-04-08T17:02:19.375Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:19.375Z"}, "affected": [{"vendor": "ThemeMove", "product": "EduMall - Professional LMS Education Center WordPress Theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_lazy_load_template' AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included."}], "title": "Edumall <= 4.2.4 - Unauthenticated Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4a0c26-6b7b-4dcf-a266-a6548431e6a8?source=cve"}, {"url": "https://changelog.thememove.com/edumall/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "timeline": [{"time": "2025-04-25T19:47:44.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-28T13:37:43.056195Z", "id": "CVE-2025-2101", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T15:34:23.704Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-2101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-28T13:37:43.056195Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-28T13:39:46.194Z"}}], "cna": {"title": "Edumall <= 4.2.4 - Unauthenticated Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Tonn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ThemeMove", "product": "EduMall - Professional LMS Education Center WordPress Theme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-04-25T19:47:44.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4a0c26-6b7b-4dcf-a266-a6548431e6a8?source=cve"}, {"url": "https://changelog.thememove.com/edumall/"}], "descriptions": [{"lang": "en", "value": "The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_lazy_load_template' AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:19.375Z"}}}, "cveMetadata": {"cveId": "CVE-2025-2101", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:19.375Z", "dateReserved": "2025-03-07T18:42:57.689Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-04-26T08:23:20.508Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EduMall - Professional LMS Education Center WordPress Theme", "vendor": "ThemeMove", "versions": [{"lessThanOrEqual": "4.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Edumall theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.2.4 via the 'template' parameter of the 'edumall_lazy_load_template' AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included."}, {"lang": "es", "value": "El tema Edumall para WordPress es vulnerable a la inclusi\u00f3n de archivos locales en todas las versiones hasta la 4.2.4 incluida, a trav\u00e9s del par\u00e1metro \"template\" de la acci\u00f3n AJAX \"edumall_lazy_load_template\". Esto permite a atacantes no autenticados incluir y ejecutar archivos PHP arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en dichos archivos. Esto puede utilizarse para eludir los controles de acceso, obtener datos confidenciales o ejecutar c\u00f3digo cuando se pueden subir e incluir archivos PHP."}], "id": "CVE-2025-2101", "lastModified": "2026-06-17T09:06:19.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2101", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-28T13:37:43.056195Z", "version": "2.0.3"}}]}, "published": "2025-04-26T09:15:19.440", "references": [{"source": "security@wordfence.com", "url": "https://changelog.thememove.com/edumall/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7a4a0c26-6b7b-4dcf-a266-a6548431e6a8?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T21:05:16.460264+00:00", "value": {"mitigation_remediation": ["Upgrade the Edumall theme to the latest release (any version newer than 4.2.4) that removes the LFI vulnerability.", "If an upgrade is not immediately possible, temporarily block the edumall_lazy_load_template AJAX endpoint by adding a firewall rule or modifying the theme\u2019s code to require authentication, or replace it with a custom function that only accepts a whitelist of safe template names.", "Validate the template parameter rigorously: reject paths containing directory traversal characters or any absolute location, and configure the web server to prevent PHP execution from directories that could contain user\u2011supplied files."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is ThemeMove\u2019s Edumall Professional LMS Education Center WordPress Theme, versions 4.2.4 and earlier. Any WordPress site that uses one of these theme releases and has not yet applied the fix is at risk.", "description_and_impact": "Edumall, a WordPress theme used to build LMS environments, contains a local file inclusion flaw in all releases up to and including 4.2.4. The vulnerability is exercised through the template parameter of the edumall_lazy_load_template AJAX action. An unauthenticated attacker can supply a path to any PHP file on the server; that file is then included and executed in the context of the web server. The result is that an attacker can run arbitrary PHP code, bypass existing access controls, read protected data, or leverage file uploads to achieve full code execution.", "risk_and_exploitability": "The flaw has a CVSS score of 8.1 and an EPSS of less than 1%, indicating high severity but a low present exploitation probability. The vulnerability is not listed in CISA KEV. Attackers exploit the weakness by sending a crafted AJAX request to the site, so the vector is via public web traffic to the edumall_lazy_load_template endpoint, allowing unauthenticated local file inclusion that can lead to remote code execution."}}}}, "created": "2026-04-21T21:15:45.447336+00:00", "updated": "2026-04-21T21:15:45.447348+00:00", "vendors": []}