Cyber Posture

CVE-2025-58901

High

Published: 18 December 2025

Published
18 December 2025
Modified
20 January 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Takeout takeout allows PHP Local File Inclusion.This issue affects Takeout: from n/a through <= 1.3.0.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely remediation of the specific LFI vulnerability in the Takeout WordPress theme through patching or updates.

SI-10 Information Input Validation good match
prevent

Requires validation of user-supplied filenames in PHP include/require statements to block malicious path traversal enabling LFI.

CM-6 Configuration Settings partial match
prevent

Enforces secure PHP configuration settings like open_basedir to restrict file access and mitigate LFI exploitation.

Security SummaryAI

CVE-2025-58901 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the AncoraThemes Takeout WordPress theme. This issue affects Takeout versions from n/a through 1.3.0. Published on 2025-12-18, it has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

A remote network-based attacker requires no privileges or user interaction but must overcome high attack complexity to exploit the vulnerability. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling local file inclusion to disclose sensitive files or facilitate further attacks such as remote code execution.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/takeout/vulnerability/wordpress-takeout-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion vulnerability in the WordPress Takeout theme version 1.3.0.

Details

CWE(s)
CWE-98

Affected Products

ancorathemes
takeout
≤ 1.3.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

The LFI vulnerability in the public-facing WordPress theme enables exploitation of a public-facing application (T1190) and facilitates collection of data from local system files such as configuration files.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References