CVE-2025-58925
Published: 18 December 2025
Summary
CVE-2025-58925 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Neptunus. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation of filename inputs to PHP include/require statements in the Neptunus theme, directly preventing local file inclusion exploitation.
Mandates timely remediation of the specific flaw in Neptunus theme versions through n/a to <=1.0.11 via patching or replacement.
Enforces restrictions on filename inputs at the web application boundary to block malicious paths targeting local file inclusion in the vulnerable theme.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
T1190 for exploiting public-facing WordPress theme vulnerability; T1005 and T1552.001 for LFI enabling remote access to local system files and credentials (e.g., wp-config.php).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Neptunus neptunus allows PHP Local File Inclusion.This issue affects Neptunus: from n/a through <= 1.0.11.
Deeper analysisAI
CVE-2025-58925, published on 2025-12-18, is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, within the axiomthemes Neptunus WordPress theme. The flaw enables PHP Local File Inclusion and affects Neptunus versions from n/a through 1.0.11. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
Unauthenticated remote attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/neptunus/vulnerability/wordpress-neptunus-theme-1-0-11-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion vulnerability in the WordPress Neptunus theme version 1.0.11.
Details
- CWE(s)