Cyber Resilience

CVE-2025-58708

High

Published: 18 December 2025

Published
18 December 2025
Modified
20 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0042 32.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-58708 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes 777. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-58708 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the axiomthemes 777 (triple-seven) WordPress theme. This issue affects all versions of the theme up to and including 1.3. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Remote, unauthenticated attackers with network access can exploit this vulnerability despite its high attack complexity and lack of required privileges or user interaction. Exploitation allows local file inclusion, potentially leading to high-impact unauthorized access to sensitive data (confidentiality), modification of system resources (integrity), and disruption of services (availability).

The Patchstack advisory provides details on this WordPress theme vulnerability at https://patchstack.com/database/Wordpress/Theme/triple-seven/vulnerability/wordpress-777-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes 777 triple-seven allows PHP Local File Inclusion.This issue affects 777: from n/a through <= 1.3.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

This is a local file inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for unauthorized access, data disclosure, and potential further impacts.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-58935Same vendor: Axiomthemes
CVE-2025-60061Same vendor: Axiomthemes
CVE-2025-60063Same vendor: Axiomthemes
CVE-2025-58889Same vendor: Axiomthemes
CVE-2025-53449Same vendor: Axiomthemes
CVE-2025-58950Same vendor: Axiomthemes
CVE-2025-53446Same vendor: Axiomthemes
CVE-2025-60064Same vendor: Axiomthemes
CVE-2025-53445Same vendor: Axiomthemes
CVE-2025-58928Same vendor: Axiomthemes

Affected Assets

axiomthemes
777
≤ 1.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the PHP LFI flaw in the WordPress theme by requiring timely identification, reporting, and correction through patching affected versions up to 1.3.

SI-10 Information Input Validation good match
prevent

Requires validating filenames supplied to PHP include/require statements to ensure they conform to expected formats and paths, preventing local file inclusion exploitation.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Monitors and scans for vulnerabilities like CVE-2025-58708 in WordPress themes, enabling detection and prioritization for remediation.

References