PHP Remote File Inclusion Vulnerability in FuelThemes WerkStatt Plugin
CVE-2025-63017

7.5HIGH

Key Information:

Vendor

WordPress
Status
Werkstatt Plugin
Vendor
CVE Published:
22 January 2026

What is CVE-2025-63017?

A vulnerability in the FuelThemes WerkStatt Plugin allows for improper control of filenames during include or require statements in PHP code. This vulnerability can lead to Local File Inclusion (LFI), which may enable an attacker to execute arbitrary PHP files on the server. The affected versions range from n/a through 1.6.6, highlighting the importance of updating to address security concerns and protect user data from potential exploitation.

Affected Version(s)

WerkStatt Plugin 0 <= 1.6.6

References

https://patchstack.com/database/Wordpress/Plugin/werkstat...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
.