PT-2025-17957 · WordPress · Edumall

Tonn · Published 2025-04-26 · Updated 2025-05-01 · CVE-2025-2101

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Edumall theme for WordPress versions up to, and including, 4.2.4

Description The issue allows unauthenticated attackers to include and execute arbitrary PHP files on the server via the template parameter of the 'edumall lazy load template' AJAX action. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where PHP files can be uploaded and included.

Recommendations For Edumall theme for WordPress versions up to, and including, 4.2.4, consider disabling the 'edumall lazy load template' AJAX action until a patch is available. Restrict access to the template parameter to minimize the risk of exploitation. Avoid using the template parameter in the affected AJAX action until the issue is resolved.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-2101

Affected Products

Edumall

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-2101 · Security Note
• https://twitter.com/CVEnew/status/1916050348797526184 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7a4a0c26-6b7b-4dcf-a266-a6548431e6a8?source=cve · Note
• https://twitter.com/cracbot/status/1917896855763013724 · Twitter Post
• https://t.me/cvenotify/119910 · Telegram Post
• https://t.me/cvetracker/22419 · Telegram Post
• https://t.me/cvedetector/23801 · Telegram Post
• https://t.me/latest_high_impact_cve/2205 · Telegram Post
• https://changelog.thememove.com/edumall · Note