CVE-2025-58214
Published: 05 September 2025
Summary
CVE-2025-58214 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the vulnerability by requiring timely patching of the PHP file inclusion flaw in the Indutri WordPress theme to version 1.3.0 or later.
Enforces validation and sanitization of filenames in PHP include/require statements to block arbitrary local file inclusion by remote attackers.
Establishes restrictive PHP configuration settings like open_basedir restrictions and disabling allow_url_include to limit file access and prevent inclusion exploits.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vuln in public-facing WordPress theme directly enables exploitation of web apps (T1190) and arbitrary PHP file execution equivalent to web shell deployment (T1505.003).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Indutri indutri allows PHP Local File Inclusion.This issue affects Indutri: from n/a through < 1.3.0.
Deeper analysisAI
CVE-2025-58214 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Gavias Indutri WordPress theme. The issue impacts all versions of Indutri from n/a through those prior to 1.3.0. It has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
Remote attackers require network access but face high attack complexity, needing no privileges or user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling attackers to include and execute arbitrary local files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/indutri/vulnerability/wordpress-indutri-theme-1-3-0-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability in the Indutri theme and indicates mitigation by updating to version 1.3.0 or later.
Details
- CWE(s)