Cyber Posture

CVE-2025-58708

High

Published: 18 December 2025

Published
18 December 2025
Modified
20 January 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes 777 triple-seven allows PHP Local File Inclusion.This issue affects 777: from n/a through <= 1.3.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the PHP LFI flaw in the WordPress theme by requiring timely identification, reporting, and correction through patching affected versions up to 1.3.

SI-10 Information Input Validation good match
prevent

Requires validating filenames supplied to PHP include/require statements to ensure they conform to expected formats and paths, preventing local file inclusion exploitation.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Monitors and scans for vulnerabilities like CVE-2025-58708 in WordPress themes, enabling detection and prioritization for remediation.

Security SummaryAI

CVE-2025-58708 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the axiomthemes 777 (triple-seven) WordPress theme. This issue affects all versions of the theme up to and including 1.3. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Remote, unauthenticated attackers with network access can exploit this vulnerability despite its high attack complexity and lack of required privileges or user interaction. Exploitation allows local file inclusion, potentially leading to high-impact unauthorized access to sensitive data (confidentiality), modification of system resources (integrity), and disruption of services (availability).

The Patchstack advisory provides details on this WordPress theme vulnerability at https://patchstack.com/database/Wordpress/Theme/triple-seven/vulnerability/wordpress-777-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

Affected Products

axiomthemes
777
≤ 1.3

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

This is a local file inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for unauthorized access, data disclosure, and potential further impacts.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References