CVE-2025-58947
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Athos athos allows PHP Local File Inclusion.This issue affects Athos: from n/a through <= 1.9.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely remediation of the known flaw in Athos theme versions through patching or upgrades.
Mandates validation of inputs controlling PHP include/require filenames to block arbitrary local file inclusion exploits.
Enforces boundary protections like web application firewalls to inspect and filter network traffic for LFI exploitation attempts targeting the vulnerable theme.
Security SummaryAI
CVE-2025-58947 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Athos WordPress theme developed by axiomthemes. The flaw affects all versions of Athos up to and including 1.9, stemming from CWE-98. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Remote attackers without privileges can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows attackers to include and execute arbitrary local files on the server, potentially leading to full server compromise through confidentiality breaches, integrity modifications, and availability disruptions, such as remote code execution.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/athos/vulnerability/wordpress-athos-theme-1-9-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability and likely includes mitigation guidance, such as updating to a patched version of the Athos theme if available.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The LFI vulnerability in the public-facing WordPress theme (Athos) allows remote unauthenticated attackers to include and execute arbitrary local files, enabling exploitation of a public-facing web application for initial access and potential RCE.