CVE-2025-53216: Glamer WordPress Theme LFI Vulnerability

CVE-2025-53216 Overview

CVE-2025-53216 is a Local File Inclusion (LFI) vulnerability in the themeuniver Glamer WordPress theme. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers can manipulate file path parameters to load arbitrary PHP files from the underlying server. The issue affects all Glamer theme versions from initial release through 1.0.2. Successful exploitation can lead to source code disclosure, sensitive configuration exposure, and in chained scenarios, remote code execution by including attacker-controlled content already present on disk.

Critical Impact

Unauthenticated attackers can include arbitrary local PHP files, potentially leading to information disclosure and code execution on WordPress sites running the Glamer theme.

Affected Products

• themeuniver Glamer WordPress theme versions <= 1.0.2
• WordPress installations using the Glamer theme
• All Glamer releases prior to a patched version

Discovery Timeline

• 2025-08-28 - CVE-2025-53216 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-53216

Vulnerability Analysis

The Glamer theme accepts user-controlled input that is concatenated into a PHP include or require statement without sufficient sanitization. This pattern, classified under [CWE-98], enables an attacker to alter the path argument so PHP loads files outside the intended directory. Because PHP executes any included file containing PHP code, the consequence extends beyond file disclosure to potential code execution when an includable file with attacker-influenced content exists on the server.

The vulnerability requires no authentication and is reachable over the network, but exploitation involves higher attack complexity, suggesting non-trivial preconditions such as specific request shaping or environment configuration. Impacted sites face risks to confidentiality, integrity, and availability of the WordPress application and the underlying host.

Root Cause

The root cause is the absence of allow-list validation on a filename or path parameter consumed by an include/require call. The theme passes attacker-controlled input directly into a file inclusion sink, violating safe-include practices that require strict path normalization and constrained directories.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to a Glamer theme endpoint that processes the vulnerable parameter. By supplying a relative or traversal-based path, the attacker forces PHP to include files such as wp-config.php for credential disclosure or log files seeded with PHP payloads for code execution. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-53216

Indicators of Compromise

• HTTP requests to Glamer theme PHP files containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f.
• Access log entries referencing sensitive files such as wp-config.php, /etc/passwd, or PHP log paths via theme parameters.
• Unexpected PHP errors referencing include() or require() warnings in error_log originating from the Glamer theme directory.

Detection Strategies

• Inspect web server access logs for query parameters containing file path patterns directed at /wp-content/themes/glamer/ URIs.
• Deploy WAF rules to flag inclusion-style payloads (traversal sequences, php://, file:// wrappers) targeting WordPress theme endpoints.
• Audit WordPress installations to enumerate sites running Glamer at version 1.0.2 or earlier.

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics platform for query-parameter anomaly detection.
• Alert on read access to wp-config.php or other sensitive files from the web server user outside expected boot sequences.
• Monitor file integrity on the theme directory to detect tampering or addition of staged payload files.

How to Mitigate CVE-2025-53216

Immediate Actions Required

• Identify all WordPress sites running the Glamer theme and confirm the installed version.
• Disable or remove the Glamer theme on sites running version 1.0.2 or earlier until a fixed release is verified.
• Restrict access to WordPress theme endpoints via WAF rules that block traversal sequences and PHP stream wrappers.

Patch Information

At the time of publication, no fixed version is referenced in the available advisory data. Monitor the Patchstack WordPress Vulnerability Report and the themeuniver vendor channels for an updated Glamer release that addresses CVE-2025-53216, and apply it immediately upon availability.

Workarounds

• Switch affected sites to an alternative, maintained WordPress theme until a patched Glamer release is published.
• Configure open_basedir in php.ini to restrict PHP file access to the WordPress document root, limiting LFI impact.
• Set allow_url_include=Off and allow_url_fopen=Off to prevent escalation to remote inclusion scenarios.
• Apply a virtual patch via a WordPress security plugin or WAF that blocks requests containing path traversal patterns to theme files.

# Configuration example: harden PHP against file inclusion abuse
# /etc/php/8.x/fpm/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Restart PHP-FPM after applying
sudo systemctl restart php-fpm