CVE-2025-58879
Published: 18 December 2025
Summary
CVE-2025-58879 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Ancorathemes Festy. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-58879 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the AncoraThemes Festy WordPress theme. This issue affects Festy versions from n/a through 1.13.0. It is associated with CWE-98 and received a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, high attack complexity, no privileges or user interaction required, and high impacts across confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely without authentication by manipulating filenames in PHP include/require statements, leading to local file inclusion. Successful exploitation allows unauthenticated remote attackers to achieve high-level compromise, including potential unauthorized access to sensitive files, code execution, data modification, or denial of service, depending on server configuration and accessible files.
Patchstack has issued an advisory documenting the local file inclusion vulnerability in the Festy WordPress theme version 1.13.0, available at https://patchstack.com/database/Wordpress/Theme/festy/vulnerability/wordpress-festy-theme-1-13-0-local-file-inclusion-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204186
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Festy festy allows PHP Local File Inclusion.This issue affects Festy: from n/a through <= 1.13.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local file inclusion (LFI) flaw in a public-facing WordPress theme, allowing unauthenticated remote attackers to manipulate PHP include/require statements for arbitrary file access or code execution, directly enabling exploitation of public-facing applications (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of identified flaws, such as patching the LFI vulnerability in Festy WordPress theme versions through 1.13.0.
Mandates validation of untrusted inputs like filenames in PHP include/require statements to block malicious local file inclusion.
Provides vulnerability scanning to identify the presence of CVE-2025-58879 in deployed WordPress themes.