PHP Remote File Inclusion Vulnerability in aThemes Addons for Elementor
CVE-2025-32158

7.5HIGH

Key Information:

Vendor

WordPress
Status
Athemes Addons For Elementor
Vendor
CVE Published:
10 April 2025

What is CVE-2025-32158?

The vulnerability allows attackers to exploit improper control over filename parameters in the aThemes Addons for Elementor plugin. This could lead to remote file inclusion, enabling unauthorized access to sensitive server files and executing malicious scripts. Users of affected versions from n/a to 1.0.15 should take prompt action to secure their installations.

Affected Version(s)

aThemes Addons for Elementor 0 <= 1.1.3

References

https://patchstack.com/database/Wordpress/Plugin/athemes-...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.