CVE-2025-52816 is a high severity (CVSS 8.1) local file inclusion flaw in the Zita WordPress theme from ThemeHunk. Versions up to and including 1.6.5 are affected. Patchstack lists 1.6.6 as the patched version, so update the theme to 1.6.6 or later on every site that uses it.
What's affected
The NVD record covers Zita from n/a through 1.6.5. It describes the weakness as improper control of the filename for an include or require statement in a PHP program, which is CWE-98.
Patchstack, which reported the issue to the CVE program, lists the same range (1.6.5 and earlier) and names 1.6.6 as the patched version. It also lists the required privilege as unauthenticated, so a visitor does not need an account. The CVSS vector in the record rates attack complexity as high, which is why the score sits at 8.1 and not higher.
The theme is distributed for WordPress sites. Child themes inherit the parent theme code, so a site running a child theme of Zita is also in scope.
How to check if you're exposed
Find every WordPress site you run that has Zita installed, including staging copies and sites that were handed over from an agency. If you have WP-CLI on the server, this lists installed themes with their versions:
wp theme list --fields=name,version,status,update
Look for a row named zita, or for a child theme whose parent is zita. A version of 1.6.5 or lower is affected. An inactive theme still sits on disk and its files can still be reached by URL on many setups, so do not assume that an unused copy is safe. Delete themes you do not use.
If you manage sites from the dashboard, open Appearance and then Themes and read the version shown on the Zita card.
What to do now
- List all sites where Zita or a child theme of Zita is installed, active or not.
- Update Zita to 1.6.6 or later from the theme update screen or with WP-CLI, after a backup.
- Delete any inactive copy of the theme that you do not need.
- Check web server logs for unusual requests that pass file names or path fragments to theme files, and keep the logs for review.
- If you cannot update at once, ask your host about a virtual patch or web application firewall rule for the theme while you schedule the change.
Why it matters
Local file inclusion happens when a PHP application builds the name of a file to load from input that a visitor can influence, and the check on that input is weak. The application then reads and runs a file the author never meant to expose. Depending on what is on the server, that can leak configuration files or secrets, and in worse cases it can lead to code running on the host. The record scores confidentiality, integrity and availability impact as high.
The attack needs no login, and themes are installed on tens of thousands of sites with little monitoring. Patchstack warns that flaws of this kind are used in mass campaigns that sweep many sites at once. Neither the record nor Patchstack says this specific CVE is exploited, and it is not on the CISA Known Exploited Vulnerabilities list. Treat the update as routine but prompt.
Quick check
Is my site safe if Zita is not the active theme?
Not necessarily. Files of an inactive theme stay on the server, and the advisory covers the installed version. Update it or remove it.
Sources
Last reviewed: 18 October 2026.
