Cyber Resilience

CVE-2025-58214

High

Published: 05 September 2025

Published
05 September 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-58214 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-58214 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Gavias Indutri WordPress theme. The issue impacts all versions of Indutri from n/a through those prior to 1.3.0. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.

Remote attackers require network access but face high attack complexity, needing no privileges or user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling attackers to include and execute arbitrary local files on the server.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/indutri/vulnerability/wordpress-indutri-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability in the Indutri theme and indicates mitigation by updating to version 1.3.0 or later.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

LFI vuln in public-facing WordPress theme directly enables exploitation of web apps (T1190) and arbitrary PHP file execution equivalent to web shell deployment (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-13408Shared CWE-98
CVE-2026-39387Shared CWE-98
CVE-2026-3425Shared CWE-98
CVE-2026-27383Shared CWE-98
CVE-2024-51319Shared CWE-98
CVE-2025-30845Shared CWE-98
CVE-2025-26985Shared CWE-98
CVE-2025-52732Shared CWE-98
CVE-2025-69078Shared CWE-98
CVE-2026-24538Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the vulnerability by requiring timely patching of the PHP file inclusion flaw in the Indutri WordPress theme to version 1.3.0 or later.

SI-10 Information Input Validation good match
prevent

Enforces validation and sanitization of filenames in PHP include/require statements to block arbitrary local file inclusion by remote attackers.

CM-6 Configuration Settings partial match
prevent

Establishes restrictive PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit file access and prevent inclusion exploits.

References