CVE-2025-50003 – This vulnerability allows attackers to include ... (How to Fix)

📋 TL;DR

This vulnerability allows attackers to include local PHP files through improper filename control in the Amuli WordPress theme. Attackers can potentially execute arbitrary code on affected WordPress installations. All WordPress sites using Amuli theme version 2.3.0 or earlier are affected.

💻 Affected Systems

Products:

axiomthemes Amuli WordPress theme

Versions: All versions up to and including 2.3.0

Operating Systems: Any OS running PHP

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with Amuli theme active

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise leading to data theft, ransomware deployment, or complete site takeover

🟠

Likely Case

Arbitrary code execution leading to backdoor installation, data exfiltration, or site defacement

🟢

If Mitigated

Limited impact if proper file permissions and web application firewalls are in place

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple HTTP requests can trigger the vulnerability without authentication

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 2.3.0

Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/amuli/vulnerability/wordpress-amuli-theme-2-3-0-local-file-inclusion-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Appearance > Themes
3. Update Amuli theme to latest version
4. Clear WordPress cache if applicable

🔧 Temporary Workarounds

Disable vulnerable theme

all

Switch to default WordPress theme until patch is applied

wp theme activate twentytwentyfour

Web Application Firewall rule

linux

Block requests containing local file inclusion patterns

ModSecurity rule: SecRule ARGS "\.\./" "id:1001,phase:2,deny,status:403,msg:'Local File Inclusion Attempt'

🧯 If You Can't Patch

Implement strict file permissions (755 for directories, 644 for files)
Deploy web application firewall with LFI protection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Appearance > Themes for Amuli version 2.3.0 or earlier

Check Version:

wp theme list --field=name,version | grep amuli

Verify Fix Applied:

Verify Amuli theme version is greater than 2.3.0 in WordPress admin

📡 Detection & Monitoring

Log Indicators:

HTTP requests with suspicious file paths in query parameters
Multiple 403 errors from WAF blocking LFI attempts
Unusual PHP file access patterns in web server logs

Network Indicators:

HTTP requests containing '../' patterns in URL parameters
Requests to theme files with unexpected parameters

SIEM Query:

source="web_server.logs" AND (url="*../*" OR parameters="*../*")

📊 Metadata

CVE ID: CVE-2025-50003

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-98

EPSS Score: 0.15% exploit probability (35.8th percentile)

Published: January 22, 2026

Last Updated: January 26, 2026

🔗 References

https://patchstack.com/database/Wordpress/Theme/amuli/vulnerability/wordpress-amuli-theme-2-3-0-local-file-inclusion-vulnerability?_s_id=cve

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-50003, you might also want to check these: