PHP Local File Inclusion Vulnerability in WP Royal Themes News Magazine X
CVE-2025-24766

7.5HIGH

Key Information:

Vendor

WordPress
Status
News Magazine X
Vendor
CVE Published:
14 August 2025

What is CVE-2025-24766?

A vulnerability exists in WP Royal Themes News Magazine X that allows for local file inclusion due to improper control of filename in PHP include/require statements. This security flaw can enable attackers to manipulate and access sensitive files on the server, posing a significant risk to the integrity and confidentiality of the web application. All versions prior to 1.2.37 are affected, emphasizing the need for immediate action to secure affected installations.

Affected Version(s)

News Magazine X <= 1.2.37

References

https://patchstack.com/database/wordpress/theme/news-maga...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
.
CVE-2025-24766 : PHP Local File Inclusion Vulnerability in WP Royal Themes News Magazine X