Cyber Posture

CVE-2025-58940

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Basil basil allows PHP Local File Inclusion.This issue affects Basil: from n/a through <= 1.3.12.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly addresses the LFI vulnerability by identifying, reporting, and correcting the improper filename control flaw in the Basil WordPress theme through patching as per advisories.

SI-10 Information Input Validation good match
prevent

Prevents exploitation of the PHP Local File Inclusion by validating filenames and paths used in include/require statements against allowed values.

CM-6 Configuration Settings partial match
prevent

Mitigates potential impact of LFI by enforcing restrictive PHP configuration settings like open_basedir to limit accessible local files.

Security SummaryAI

CVE-2025-58940 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, classified as a PHP Remote File Inclusion issue but manifesting as PHP Local File Inclusion (LFI), affecting the Basil WordPress theme developed by axiomthemes. The vulnerability impacts Basil theme versions from n/a through 1.3.12 inclusive. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts despite requiring high attack complexity.

Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction or privileges. Exploitation enables high confidentiality, integrity, and availability impacts, allowing inclusion of arbitrary local files, which could lead to sensitive data exposure, server modification, or disruption depending on the target's configuration.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/basil/vulnerability/wordpress-basil-theme-1-3-12-local-file-inclusion-vulnerability?_s_id=cve, which documents the LFI vulnerability specific to the WordPress Basil theme version 1.3.12.

Details

CWE(s)
CWE-98

Affected Products

axiomthemes
basil
≤ 1.3.12

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

CVE enables exploitation of a public-facing WordPress theme (T1190) via LFI, directly facilitating arbitrary local file inclusion for data theft (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References