CVE-2025-60046: WordPress HeartStar theme <= 1.0.14 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes HeartStar heartstar allows PHP Local File Inclusion.This issue affects HeartStar: from n/a through <= 1.0.14.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60046?
CVE-2025-60046 is classified as a critical severity vulnerability due to its potential for remote file inclusion leading to system compromise.
How do I fix CVE-2025-60046?
To fix CVE-2025-60046, update the HeartStar theme to a version later than 1.0.14 where the vulnerability is resolved.
What versions of HeartStar are affected by CVE-2025-60046?
CVE-2025-60046 affects HeartStar versions from n/a through 1.0.14 inclusive.
What type of vulnerability is CVE-2025-60046?
CVE-2025-60046 is categorized as a PHP Remote File Inclusion vulnerability that allows for local file inclusion due to improper control of filenames.
What impact can CVE-2025-60046 have on my website?
If exploited, CVE-2025-60046 can allow attackers to execute arbitrary PHP code on the server, potentially leading to full site compromise.