Cyber Posture

CVE-2025-59558

High

Published: 22 October 2025

Published
22 October 2025
Modified
29 January 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Security Summary

CVE-2025-59558 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the ThemeMove Billey WordPress theme. This flaw affects Billey versions from n/a through those prior to 2.1.6.

Unauthenticated remote attackers can exploit the vulnerability over the network (AV:N) without user interaction (UI:N) and with no privileges required (PR:N), though it demands high attack complexity (AC:H). Exploitation within unchanged scope (S:U) can result in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 8.1.

The Patchstack advisory details the Local File Inclusion vulnerability in the WordPress Billey theme and indicates it is addressed in version 2.1.6. Mitigation involves updating affected Billey installations to 2.1.6 or later.

Details

CWE(s)
CWE-98

Affected Products

thememove
billey
≤ 2.1.6

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Why these techniques?

LFI in public-facing WordPress theme enables T1190 for initial exploitation; facilitates arbitrary local file reads for T1005 data collection, T1083 file discovery, and T1552.001 credential access from files like wp-config.php.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References