A vulnerability described as critical has been identified in Select-Themes Moments Plugin up to 2.2 on WordPress. The impacted element is an unknown function. The manipulation results in improper control of filename for include/require statement in php program ('php remote file inclusion'). This vulnerability is identified as CVE-2026-25458.
| Vendor | Product | Versions |
|---|---|---|
| Select-Themes | Moments | n/a |
Updated severity to CRITICAL, marked as actively exploited, and corrected exploit availability.
Initial creation
