CVE-2025-58950
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lione lione allows PHP Local File Inclusion.This issue affects Lione: from n/a through <= 1.16.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-58950 by identifying, reporting, and correcting the improper PHP include/require filename control flaw in the Lione WordPress theme through patching or updates.
Prevents exploitation of the LFI vulnerability by validating user-supplied filename inputs to PHP include/require statements against allowed paths and patterns.
Hardens the system by enforcing secure PHP configuration settings, such as open_basedir restrictions or disabling allow_url_include, to limit potential LFI impacts.
Security SummaryAI
CVE-2025-58950 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the Lione WordPress theme developed by axiomthemes. The issue affects Lione versions from n/a through 1.16 inclusive. It is associated with CWE-98 and received a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2025-12-18.
Unauthenticated attackers with network access can exploit this vulnerability despite requiring high attack complexity and no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, enabling attackers to include and potentially execute local files on the server through improper PHP include/require controls.
The Patchstack advisory provides details on this Local File Inclusion vulnerability specific to the WordPress Lione theme version 1.16, available at https://patchstack.com/database/Wordpress/Theme/lione/vulnerability/wordpress-lione-theme-1-16-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this reference for mitigation guidance, such as applying available patches or theme updates.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme allows unauthenticated remote exploitation of improper PHP include/require controls, directly enabling T1190: Exploit Public-Facing Application.