CVE-2025-69059highCWE-98

CVE-2025-69059: high-severity vulnerability in AncoraThemes DiveIt

WordPress DiveIt theme <= 1.4.3 - Local File Inclusion vulnerability

Published · Updated

Follow this CVE+ Monitor DiveIt

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.6%
In short

The DiveIt WordPress theme allows attackers to include and execute arbitrary local files on the server through improper input handling. This can lead to sensitive data exposure or remote code execution if combined with other techniques.

Technical detail

A PHP Local File Inclusion (LFI) vulnerability exists in DiveIt theme <= 1.4.3 due to improper validation of filename parameters in include/require statements (CWE-98). An unauthenticated attacker can manipulate input to include arbitrary files from the server, potentially leading to information disclosure or code execution depending on file permissions and availability.

Summary generated and translated by AI from the official description.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DiveIt diveit allows PHP Local File Inclusion.This issue affects DiveIt: from n/a through <= 1.4.3.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
AncoraThemes · DiveIt