Cyber Posture

CVE-2025-58706

High

Published: 18 December 2025

Published
18 December 2025
Modified
20 January 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Woo Hoo woohoo allows PHP Local File Inclusion.This issue affects Woo Hoo: from n/a through <= 1.25.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of filenames in PHP include/require statements, directly preventing local file inclusion by rejecting malicious inputs.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely remediation of known flaws like CVE-2025-58706 by patching the vulnerable Woo Hoo WordPress theme to version >1.25.

CM-6 Configuration Settings partial match
prevent

CM-6 enforces secure PHP configuration settings such as open_basedir restrictions and allow_url_include=Off to limit file access paths exploitable by LFI.

Security SummaryAI

CVE-2025-58706 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the Woo Hoo WordPress theme developed by axiomthemes. The issue affects Woo Hoo versions from n/a through 1.25 inclusive. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited remotely over the network by unauthenticated attackers requiring no privileges or user interaction, though high attack complexity is needed. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing inclusion of arbitrary local PHP files, which could lead to sensitive data exposure or code execution depending on server configuration.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/woohoo/vulnerability/wordpress-woo-hoo-theme-1-25-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

Affected Products

axiomthemes
woo hoo
≤ 1.25

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

LFI vulnerability in public-facing WordPress theme exploitable remotely by unauthenticated attackers, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References