Local File Inclusion Vulnerability in Edumall WordPress Theme

CVE-2025-2101

What is CVE-2025-2101?

The Edumall theme for WordPress is susceptible to a Local File Inclusion vulnerability due to improper handling of the 'template' parameter in the 'edumall_lazy_load_template' AJAX action. An unauthenticated attacker can exploit this issue to include and execute arbitrary PHP files from the server, which can lead to severe outcomes such as unauthorized code execution, sensitive data exposure, and potential bypassing of access controls. This vulnerability affects all versions of the Edumall theme up to and including 4.2.4, emphasizing the importance of applying necessary security updates and following best practices to secure WordPress installations.

References