CVE-2025-58932
Published: 18 December 2025
Summary
CVE-2025-58932 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Prisma. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-58932 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion, in the axiomthemes Prisma WordPress theme. The flaw allows PHP Local File Inclusion and affects Prisma versions from n/a through 1.10. Published on 2025-12-18, it is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network without requiring user interaction, though it demands high attack complexity. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, potentially allowing attackers to include and execute local files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/prisma/vulnerability/wordpress-prisma-theme-1-10-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion vulnerability in the WordPress Prisma theme version 1.10.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204163
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Prisma prisma allows PHP Local File Inclusion.This issue affects Prisma: from n/a through <= 1.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote Local File Inclusion in a public-facing WordPress theme, directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2025-58932 by requiring timely identification, reporting, and patching of the Local File Inclusion flaw in the Prisma WordPress theme versions up to 1.10.
Prevents exploitation of the improper filename control in PHP include/require by validating all user-supplied inputs for filenames and paths to block malicious Local File Inclusion attempts.
Mitigates impact by establishing secure configuration settings for PHP, such as open_basedir restrictions, to limit file access and prevent arbitrary local file execution via inclusion.