PT-2026-4015 · Bzotheme · Mella

Published 2026-01-22 · Updated 2026-01-22 · CVE-2025-67616

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mella versions prior to 1.2.30

Description Improper control of the filename for the Include/Require statement in the PHP program allows for Local File Inclusion. This occurs when the application does not sufficiently validate the file paths used in include or require functions, potentially allowing an attacker to read or execute files on the server.

Recommendations Update to a version later than 1.2.29.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-67616

Affected Products

Mella

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2025-67616 · Security Note
• https://patchstack.com/database/Wordpress/Theme/mella/vulnerability/wordpress-mella-theme-1-2-29-local-file-inclusion-vulnerability?_s_id=cve · Note