CVE-2025-54701 is a high severity (CVSS 8.1) PHP local file inclusion in the ThemeMove Unicamp WordPress theme. Versions through 2.6.3 are affected. The record names no fixed release, so check for an update from ThemeMove or remove the theme. The sections below cover who is affected, how to check, and what to do first.
What's affected
- Unicamp versions through 2.6.3 are affected, per the record.
- The record does not name a fixed version. Check the vendor and the Patchstack entry.
The record lists CVSS 8.1 (High). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
List your themes and versions with WP-CLI.
wp theme list
If Unicamp appears at 2.6.3 or below, it is affected. A child theme that depends on it counts too.
What to do now
- Check for a newer Unicamp release and update if one exists.
- If there is no fix, move to another theme and delete Unicamp.
- Update WordPress core and plugins.
- Review web logs for requests with unusual file path values.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weakness is CWE-98. This is the same class as CVE-2025-54700 in a sibling ThemeMove theme, published the same day. It suggests shared code, though the record does not say so.
If you run more than one ThemeMove theme, check all of them.
Severity scores are a starting point. The score for this entry is 8.1, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Quick check
Is this the same bug as CVE-2025-54700?
The class and score match, but they are separate entries for separate themes.
What if the vendor has no patch?
Replace the theme.
Sources
Last reviewed: 18 October 2026.
