CVE-2025-54700 is a high severity (CVSS 8.1) PHP local file inclusion in the ThemeMove Makeaholic WordPress theme. Versions through 1.8.4 are affected. The record names no fixed release, so check for an update from ThemeMove or remove the theme. The sections below cover who is affected, how to check, and what to do first.
What's affected
- Makeaholic versions through 1.8.4 are affected, per the record.
- The record does not name a fixed version. Check the vendor and the Patchstack entry.
The record lists CVSS 8.1 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
List your themes and versions with WP-CLI.
wp theme list
If Makeaholic appears at 1.8.4 or below, it is affected, even if it is inactive. Inactive themes still sit on disk.
What to do now
- Check for a newer Makeaholic release and update if one exists.
- If there is no fix, switch to another theme and delete Makeaholic.
- Keep WordPress core and plugins current.
- Review web logs for odd requests that carry file paths.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-98, improper control of the filename in an include statement. A PHP include that takes a value from a request can be pointed at other local files, which may expose secrets or run code already on the server.
Theme and plugin bugs are the main source of WordPress compromise. Inventory is half the fix. A scan of your dependencies shows which components are on which sites.
Severity scores are a starting point. The score for this entry is 8.1, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Does an inactive theme matter?
Yes. Its files are still on disk and may be reachable.
Is there a patch?
The record names none. Check the vendor.
Sources
Last reviewed: 18 October 2026.
