PHP Remote File Inclusion Vulnerability in AdForest Theme by ScriptsBundle
CVE-2025-67946

8.1HIGH

Key Information:

Vendor

WordPress
Status
Adforest
Vendor
CVE Published:
22 January 2026

What is CVE-2025-67946?

The vulnerability identified in the AdForest theme by ScriptsBundle involves improper control of filenames within PHP include/require statements. This design flaw allows attackers to exploit the functionality, leading to potential Local File Inclusion (LFI) attacks within the web application. Specifically, this affects versions of AdForest up to and including 6.0.11, allowing unauthorized file access and manipulation on the server. Immediate action is recommended for users operating affected versions to mitigate security risks.

Affected Version(s)

AdForest 0 <= 6.0.11

References

https://patchstack.com/database/Wordpress/Theme/adforest/...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
.