Attack Vectors

The WordPress theme Vizeon – Business Consulting (slug: vizeon) is affected by a Critical vulnerability (CVE-2025-31064) that can be exploited without logging in. This means attackers can target your public website directly over the internet, without needing user interaction, credentials, or access to your WordPress admin area.

In practical terms, an attacker may try to trick the theme into loading files from the server that were never intended to be exposed. If they can get the site to load a file containing PHP code, they may be able to run that code on your server. In some situations, this can also be combined with file upload paths (including “safe” file types) if those uploads can later be included.

Security Weakness

CVE-2025-31064 is an Unauthenticated Local File Inclusion (LFI) vulnerability affecting Vizeon – Business Consulting versions up to and including 1.1.7. LFI issues occur when a site component allows a visitor to influence which server-side file is loaded, potentially exposing sensitive files or enabling code execution depending on what files are accessible and how the server is configured.

The risk is especially high here because the reported impact includes the ability to include and execute arbitrary files on the server when those files contain PHP code. The vulnerability has a CVSS 9.8 score (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting the likelihood of remote exploitation and the potential for complete compromise of confidentiality, integrity, and availability.

Technical or Business Impacts

For business leaders, the most important takeaway is that this Critical issue can enable outcomes consistent with a full website takeover. That can translate into brand damage, lost revenue, operational disruption, and potential compliance exposure.

Potential impacts include:

Data exposure: attackers may access sensitive information stored on the server or within WordPress, creating privacy and regulatory concerns for compliance teams.

Website defacement or malicious content injection: attackers could alter site content to harm brand trust, mislead customers, or insert unauthorized marketing/SEO spam that undermines campaign performance and search visibility.

Business interruption: the site may be slowed, disabled, or used as a platform for further attacks, affecting lead generation, customer communication, and online sales channels.

Downstream risk: a compromised site can be used to target visitors (for example, with phishing pages), which can escalate reputational impact beyond the immediate incident.

Similar Attacks

Local File Inclusion and related file-loading weaknesses have been repeatedly leveraged in real-world breaches. Examples include:

Citrix “Bleed” (CVE-2023-4966) — CISA Known Exploited Vulnerabilities listing

Apache HTTP Server path traversal and file disclosure (CVE-2021-41773) — NVD

Log4Shell (CVE-2021-44228) — NVD

Remediation

There is no known patch available for CVE-2025-31064 affecting Vizeon – Business Consulting through version 1.1.7. Given the Critical severity and unauthenticated nature of the risk, organizations should evaluate immediate mitigation actions aligned to their risk tolerance.

For many organizations, the safest course is to uninstall the affected theme and replace it with a supported alternative. If replacement is not immediately feasible, consider compensating controls to reduce exposure, such as restricting access paths where possible, strengthening monitoring for unusual requests, and reviewing server and WordPress configurations for unnecessary file exposure. Use the official advisory details to guide decisions: CVE-2025-31064 and the source report: Wordfence vulnerability record.