CVE-2025-53440: WordPress Confidant theme <= 1.4 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local File Inclusion.
This issue affects Confidant: from n/a through 1.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Axiomthemes Confidantfrom your environment.Uninstall the Axiomthemes Confidant (Confidant) WordPress theme if it is present and is version 1.4 or earlier.
- Configuration
Deactivate the Confidant theme in WordPress (do not use versions <= 1.4). Switch to a different, trusted theme until a fix is available.
WordPress Confidant theme active = false - Compensating control
If immediate deactivation/removal is not possible, restrict administrative access and access to theme files (theme editor, file manager, uploads) to trusted administrator IPs/accounts only until a safe remediation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53440?
CVE-2025-53440 has a severity score of 8.1, categorizing it as high risk.
How do I fix CVE-2025-53440?
To fix CVE-2025-53440, update the Confidant theme to version 1.4 or later.
What type of vulnerability is CVE-2025-53440?
CVE-2025-53440 is a Local File Inclusion vulnerability affecting the Confidant theme.
What systems are affected by CVE-2025-53440?
CVE-2025-53440 affects the Confidant theme version 1.4 and earlier.
What are the potential impacts of CVE-2025-53440?
CVE-2025-53440 can lead to unauthorized access to sensitive files on the server.