Local File Inclusion Vulnerability in Madara WordPress Theme

CVE-2025-4524

What is CVE-2025-4524?

The Madara theme for WordPress, designed for manga sites, is susceptible to a Local File Inclusion vulnerability. This issue arises through the 'template' parameter, allowing unauthenticated attackers to include and execute arbitrary files on the server. The vulnerability enables potential code execution of any PHP code contained within included files, leading to risks such as bypassing access controls, gaining unauthorized access to sensitive data, and executing malicious scripts, particularly when file uploads involve commonly accepted types like images.

References