CVE-2025-58206
Published: 05 September 2025
Summary
CVE-2025-58206 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Thememove Maxcoach. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validation of user-supplied filenames used in PHP include/require statements, directly preventing local file inclusion by rejecting malicious paths.
SI-2 requires timely remediation of flaws like CVE-2025-58206 through patching the vulnerable MaxCoach theme versions up to 3.2.5.
RA-5 enables vulnerability scanning to identify the unpatched LFI vulnerability in MaxCoach themes, facilitating remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress/PHP app directly enables T1190 exploitation and arbitrary code execution via included PHP files (T1505.003 web shell).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP Local File Inclusion.This issue affects MaxCoach: from n/a through <= 3.2.5.
Deeper analysisAI
CVE-2025-58206 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the ThemeMove MaxCoach WordPress theme. This issue affects MaxCoach versions from n/a through 3.2.5.
The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with high attack complexity, no required privileges or user interaction, and unchanged scope. Remote attackers can exploit it to achieve high impacts on confidentiality, integrity, and availability, potentially reading or including local files to disclose sensitive data or execute arbitrary code if suitable local PHP files are accessible.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/maxcoach/vulnerability/wordpress-maxcoach-theme-3-2-5-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion vulnerability in MaxCoach 3.2.5.
Details
- CWE(s)