CVE-2025-39494 is a high severity PHP local file inclusion flaw (CVSS 8.1) in the Mikado-Themes Wilmer WordPress theme, in versions before 3.4.2. Update to 3.4.2 or later on every site that runs the theme, and review web server logs for requests that try to load unexpected files.
What's affected
The record names the Mikado-Themes Wilmer theme, versions from n/a before 3.4.2, and describes improper control of the filename in a PHP include or require statement, which allows local file inclusion.
Patchstack's page for this entry lists versions below 3.4.2 as vulnerable and 3.4.2 as the patched version, and advises updating to 3.4.2 or later.
The record lists the weakness as CWE-98 (improper control of the filename for an include or require statement in a PHP program). The CVSS 3.1 score is 8.1 (high), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector shows the flaw can be reached over the network, and no login is needed. Attack complexity is rated high, which holds the score down. Confidentiality impact is rated high, integrity high and availability high.
The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Patchstack's page rates the issue as high priority and expects it to be exploited at scale, which is a forecast and not a report of attacks. Treat internet facing sites as the priority.
How to check if you're exposed
Check each WordPress install for the theme and its version.
- With WP-CLI, list the theme and its version on each site:
wp theme list --fields=name,status,version | grep -i wilmer
- Without WP-CLI, open the Themes page in the dashboard and read the version under Wilmer. Compare it with 3.4.2.
- Look for version 3.4.2 or later, the patched version listed by Patchstack.
- Remember that an inactive theme or plugin can still be reachable on disk. Check the folder under wp-content as well, and delete anything you do not use.
If you manage many sites, the free in-browser dependency scan covers application dependencies, and the Gold directory lets you look up other CVEs by product. Themes and plugins still need to be checked on each site.
What to do now
- Update the Wilmer theme to 3.4.2 or later on every site, then clear caches.
- If you cannot update today, switch to another theme or restrict access while you plan the update.
- Review web server logs for requests with unusual path values in theme parameters, such as references to parent directories.
- Keep sensitive files such as configuration backups out of the web root, and make sure file permissions are tight.
- Run PHP with settings that limit which directories scripts can open, where your host allows it.
- Remove themes you do not use, so that unused code is not left on the server.
Why it matters
Local file inclusion happens when a PHP script builds the name of a file to load from input it does not control, and then loads it. The script may then read or run a file that was never meant to be reachable. What follows depends on which files exist on the server and what the web server account can read.
The record lists CWE-98, improper control of the filename for an include or require statement. The score is 8.1 and not higher because the vector rates attack complexity as high. That still leaves a serious flaw in a theme that may run on public sites. The fix is a version update, and the practical risk lies in the sites that nobody updates.
Quick check
Which version fixes CVE-2025-39494?
Patchstack lists 3.4.2 as the patched version, and the record covers versions before 3.4.2. Update to 3.4.2 or later.
Why is the score not higher?
The vector rates attack complexity as high, so the attacker needs more than a single simple request. The flaw is still worth fixing promptly.
Sources
- Gold entry for CVE-2025-39494
- NVD record for CVE-2025-39494, published 2025-05-23, as summarized above
- Patchstack entry for Wilmer
Last reviewed: 18 October 2026.
