CVE-2025-58895
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Integro integro allows PHP Local File Inclusion.This issue affects Integro: from n/a through <= 1.8.0.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-58895 by requiring timely remediation of the PHP Local File Inclusion flaw in vulnerable Integro WordPress theme versions through patching as advised by Patchstack.
Prevents exploitation of the improper filename control in PHP include/require by validating and sanitizing user-controlled inputs to block path traversal and arbitrary local file inclusion.
Detects the presence of CVE-2025-58895 in deployed systems via vulnerability scanning of WordPress themes, enabling identification and patching before remote exploitation.
Security SummaryAI
CVE-2025-58895 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and commonly known as PHP Remote File Inclusion, that enables PHP Local File Inclusion in the Integro WordPress theme developed by AncoraThemes. The flaw affects all versions of the Integro theme from n/a through 1.8.0, as published on 2025-12-18.
Remote attackers can exploit this vulnerability over the network (AV:N) with high attack complexity (AC:H), requiring no privileges (PR:N) or user interaction (UI:N), and without changing scope (S:U). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 8.1, potentially allowing arbitrary file inclusion, code execution, data disclosure, or server compromise on affected WordPress sites running vulnerable Integro theme versions.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/integro/vulnerability/wordpress-integro-theme-1-8-0-local-file-inclusion-vulnerability?_s_id=cve, which documents the vulnerability in the WordPress Integro theme version 1.8.0.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote file inclusion flaw in a public-facing WordPress theme, enabling unauthenticated remote code execution and server compromise, directly mapping to T1190: Exploit Public-Facing Application.