CVE-2025-58947
Published: 18 December 2025
Summary
CVE-2025-58947 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Athos. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-58947 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the Athos WordPress theme developed by axiomthemes. The flaw affects all versions of Athos up to and including 1.9, stemming from CWE-98. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
Remote attackers without privileges can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows attackers to include and execute arbitrary local files on the server, potentially leading to full server compromise through confidentiality breaches, integrity modifications, and availability disruptions, such as remote code execution.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/athos/vulnerability/wordpress-athos-theme-1-9-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability and likely includes mitigation guidance, such as updating to a patched version of the Athos theme if available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204149
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Athos athos allows PHP Local File Inclusion.This issue affects Athos: from n/a through <= 1.9.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The LFI vulnerability in the public-facing WordPress theme (Athos) allows remote unauthenticated attackers to include and execute arbitrary local files, enabling exploitation of a public-facing web application for initial access and potential RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring timely remediation of the known flaw in Athos theme versions through patching or upgrades.
Mandates validation of inputs controlling PHP include/require filenames to block arbitrary local file inclusion exploits.
Enforces boundary protections like web application firewalls to inspect and filter network traffic for LFI exploitation attempts targeting the vulnerable theme.