CVE-2026-25379
Local File Inclusion in StreamVid PHP Causes Code Execution Risk
Publication date: 2026-03-25
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jwsthemes | streamvid | to 6.8.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to the exposure of sensitive files on the target website.
Attackers may obtain database credentials, which could result in a complete database takeover depending on the website’s configuration.
Because no authentication is required to exploit this flaw, it poses a high risk and is often targeted in mass-exploit campaigns.
This can lead to data breaches, loss of data integrity, and compromise of the entire website.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The CVE-2026-25379 vulnerability is a Local File Inclusion (LFI) issue in the StreamVid WordPress Theme prior to version 6.8.6. Detection typically involves monitoring for attempts to include local files via URL parameters or suspicious HTTP requests targeting the theme.
While specific commands are not provided in the resources, common detection methods include analyzing web server logs for unusual requests containing file inclusion patterns such as "?file=", "?include=", or directory traversal sequences like "../".
Network intrusion detection systems (NIDS) or web application firewalls (WAF) can be configured to alert on such patterns. Patchstack also provides mitigation rules that can help detect and block attacks targeting this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to update the StreamVid WordPress Theme to version 6.8.6 or later, where the vulnerability has been patched.
If updating immediately is not possible, applying the mitigation rule provided by Patchstack can block attacks targeting this vulnerability and offer rapid protection.
Additionally, users are advised to seek assistance from their hosting provider or web developer to implement temporary protections until the update can be applied.
Prompt remediation is critical to prevent exploitation, as no privileges are required to exploit this vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-25379 vulnerability allows unauthenticated attackers to include and display local files from the target website, potentially exposing sensitive information such as database credentials.
Exposure of sensitive data due to this vulnerability could lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
Therefore, failure to remediate this vulnerability promptly may result in non-compliance with these common standards and regulations, increasing the risk of legal and financial consequences.
Mitigation involves updating the StreamVid Theme to version 6.8.6 or later and applying available protection rules to prevent exploitation.
Can you explain this vulnerability to me?
CVE-2026-25379 is a high-priority Local File Inclusion (LFI) vulnerability found in the WordPress StreamVid Theme versions prior to 6.8.6.
This vulnerability allows unauthenticated attackers to include and display local files from the target website.
By exploiting this flaw, attackers can potentially access sensitive information such as database credentials.
No privileges are required to exploit this vulnerability, making it particularly dangerous.
The issue falls under the OWASP Top 10 category A3: Injection and is specifically classified as a Local File Inclusion flaw.