CVE-2025-58879
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Festy festy allows PHP Local File Inclusion.This issue affects Festy: from n/a through <= 1.13.0.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of identified flaws, such as patching the LFI vulnerability in Festy WordPress theme versions through 1.13.0.
Mandates validation of untrusted inputs like filenames in PHP include/require statements to block malicious local file inclusion.
Provides vulnerability scanning to identify the presence of CVE-2025-58879 in deployed WordPress themes.
Security SummaryAI
CVE-2025-58879 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the AncoraThemes Festy WordPress theme. This issue affects Festy versions from n/a through 1.13.0. It is associated with CWE-98 and received a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, high attack complexity, no privileges or user interaction required, and high impacts across confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely without authentication by manipulating filenames in PHP include/require statements, leading to local file inclusion. Successful exploitation allows unauthenticated remote attackers to achieve high-level compromise, including potential unauthorized access to sensitive files, code execution, data modification, or denial of service, depending on server configuration and accessible files.
Patchstack has issued an advisory documenting the local file inclusion vulnerability in the Festy WordPress theme version 1.13.0, available at https://patchstack.com/database/Wordpress/Theme/festy/vulnerability/wordpress-festy-theme-1-13-0-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local file inclusion (LFI) flaw in a public-facing WordPress theme, allowing unauthenticated remote attackers to manipulate PHP include/require statements for arbitrary file access or code execution, directly enabling exploitation of public-facing applications (T1190).