CVE-2025-59564
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The EduMall theme by ThemeMove has a PHP Local File Inclusion vulnerability due to improper filename control in include/require statements. Affects versions up to 4.4.5 (exclusive).
Risk Assessment
An attacker could exploit this to read sensitive files on the server or execute malicious code, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update the EduMall theme to version 4.4.5 or later. Restrict access to theme files and monitor server logs.
Other vulnerabilities in EduMall
See all- CVE-2026-39748High
A vulnerability in the EduMall theme up to version 4.5.3 allows an unauthenticated attacker to perform cross-site scripting (XSS).
- CVE-2026-57797Medium
The EduMall WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 4.5.1.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through < 4.4.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS