CVE-2025-6991

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6991", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-01T21:14:20.796Z", "datePublished": "2025-07-26T07:23:52.298Z", "dateUpdated": "2026-04-08T17:28:14.869Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:14.869Z"}, "affected": [{"vendor": "hogash", "product": "KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.21.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The kallyas theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.21.0 via the 'TH_LatestPosts4` widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de1bcbea-5539-456f-94dc-c70fb7acc455?source=cve"}, {"url": "https://themeforest.net/item/kallyas-responsive-multipurpose-wordpress-theme/4091658"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "timeline": [{"time": "2025-07-25T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-28T15:10:30.266468Z", "id": "CVE-2025-6991", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T15:10:41.674Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-28T15:10:30.266468Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-28T15:10:36.398Z"}}], "cna": {"title": "Kallyas <= 4.21.0 - Authenticated (Contributor+) Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Matthew Rollings"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "hogash", "product": "KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.21.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-25T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de1bcbea-5539-456f-94dc-c70fb7acc455?source=cve"}, {"url": "https://themeforest.net/item/kallyas-responsive-multipurpose-wordpress-theme/4091658"}], "descriptions": [{"lang": "en", "value": "The kallyas theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.21.0 via the 'TH_LatestPosts4` widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:14.869Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6991", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:14.869Z", "dateReserved": "2025-07-01T21:14:20.796Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-26T07:23:52.298Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme", "vendor": "hogash", "versions": [{"lessThanOrEqual": "4.21.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The kallyas theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.21.0 via the 'TH_LatestPosts4` widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El tema kallyas para WordPress es vulnerable a la inclusi\u00f3n local de archivos en todas las versiones hasta la 4.21.0 (incluida) a trav\u00e9s del widget 'TH_LatestPosts4'. Esto permite a atacantes autenticados, con acceso de colaborador o superior, incluir y ejecutar archivos .php arbitrarios en el servidor, lo que permite la ejecuci\u00f3n de cualquier c\u00f3digo PHP en dichos archivos. Esto puede utilizarse para eludir los controles de acceso, obtener datos confidenciales o ejecutar c\u00f3digo cuando se pueden subir e incluir archivos .php."}], "id": "CVE-2025-6991", "lastModified": "2026-06-17T10:03:00.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6991", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-28T15:10:30.266468Z", "version": "2.0.3"}}]}, "published": "2025-07-26T08:15:26.337", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/kallyas-responsive-multipurpose-wordpress-theme/4091658"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/de1bcbea-5539-456f-94dc-c70fb7acc455?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T20:05:47.618021+00:00", "value": {"mitigation_remediation": ["Upgrade the KALLYAS theme to the latest released version, which removes the vulnerable TH_LatestPosts4 widget functionality.", "If an upgrade is delayed, immediately disable the TH_LatestPosts4 widget for all contributors and higher users or remove its access entirely so that only administrators can use it.", "Restrict uploaded file types on the server and configure PHP to prevent execution of user\u2011uploaded or locally stored PHP files; apply file\u2011type and MIME type validation to block execution of attacker\u2011controlled code."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution"}, "threat_synthesis": {"affected_systems": "All releases of the theme up to and including version 4.21.0 are affected. The theme is distributed by hogash as a multi\u2011purpose WordPress theme for eCommerce sites. The flaw therefore applies to any WordPress installation that has installed any of these vulnerable versions, regardless of the specific site content or configuration. Administrators should identify whether the site uses KALLYAS and verify the particular version number.", "description_and_impact": "The KALLYAS WordPress theme contains a local file inclusion flaw in the TH_LatestPosts4 widget. Because the widget evaluates user\u2011supplied parameters and includes them without proper validation, an attacker who can authenticate with Contributor or higher privileges can include any .php file present on the server. This enables arbitrary PHP execution, which can be used to bypass the WordPress access controls, read sensitive files, or run malicious code. The vulnerability is a classic example of CWE-98.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity with moderate\u2011to\u2011high impact. The EPSS score is less than 1%, suggesting that the probability of an exploitation carry on a given day is low, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw requires authenticated access, it is practical only for attackers who can gain Contributor or higher roles, but those roles are typically granted to trusted collaborators. If an attacker obtains such credentials, code execution can be achieved without further privilege escalation. The attack vector is Web\u2011based, leveraging the WordPress admin interface and the vulnerable widget."}}}}, "created": "2025-07-28T12:45:44.144609+00:00", "updated": "2026-04-20T20:15:06.219167+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}