Local File Inclusion Vulnerability in Thembay Puca Theme
CVE-2025-30992

8.1HIGH

Key Information:

Vendor

WordPress
Status
Puca
Vendor
CVE Published:
27 June 2025

What is CVE-2025-30992?

A vulnerability exists in Thembay's Puca Theme that allows for PHP Local File Inclusion due to improper control of filename parameters in PHP's include/require statements. This flaw can lead to unauthorized access to sensitive files on the server, posing significant security risks. Users of the Puca Theme versions from n/a through 2.6.33 should take immediate action to update to the latest version to mitigate potential threats.

Affected Version(s)

Puca <= 2.6.33

References

https://patchstack.com/database/wordpress/theme/puca/vuln...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO - BlueRock (Patchstack Alliance)
.
CVE-2025-30992 : Local File Inclusion Vulnerability in Thembay Puca Theme