CVE-2025-58803
Published: 18 December 2025
Summary
CVE-2025-58803 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Algenix. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific Local File Inclusion flaw in the Algenix WordPress theme by identifying, patching, or removing the vulnerable component.
Validates user-supplied filenames prior to PHP include/require operations to block arbitrary local file paths.
Restricts filenames accepted for PHP include/require to whitelisted safe values or patterns, preventing exploitation of improper filename controls.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Public-facing WordPress theme LFI vulnerability enables exploitation of public-facing applications (T1190) and arbitrary local file inclusion, facilitating file/directory discovery (T1083), data collection from local system (T1005), and access to credentials in files (T1081).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Algenix algenix allows PHP Local File Inclusion.This issue affects Algenix: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-58803 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), affecting the Algenix WordPress theme by axiomthemes. This issue impacts Algenix versions from n/a through 1.0 inclusive, with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit the vulnerability over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks can result in high-impact compromise of confidentiality, integrity, and availability, allowing inclusion of arbitrary local files on the server.
The primary advisory from Patchstack, available at https://patchstack.com/database/Wordpress/Theme/algenix/vulnerability/wordpress-algenix-theme-1-0-local-file-inclusion-vulnerability?_s_id=cve, documents this Local File Inclusion vulnerability in the Algenix WordPress theme version 1.0. Security practitioners should review this reference for detailed mitigation recommendations.
Details
- CWE(s)