CVE-2025-58950
Published: 18 December 2025
Summary
CVE-2025-58950 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Lione. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-58950 by identifying, reporting, and correcting the improper PHP include/require filename control flaw in the Lione WordPress theme through patching or updates.
Prevents exploitation of the LFI vulnerability by validating user-supplied filename inputs to PHP include/require statements against allowed paths and patterns.
Hardens the system by enforcing secure PHP configuration settings, such as open_basedir restrictions or disabling allow_url_include, to limit potential LFI impacts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme allows unauthenticated remote exploitation of improper PHP include/require controls, directly enabling T1190: Exploit Public-Facing Application.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lione lione allows PHP Local File Inclusion.This issue affects Lione: from n/a through <= 1.16.
Deeper analysisAI
CVE-2025-58950 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the Lione WordPress theme developed by axiomthemes. The issue affects Lione versions from n/a through 1.16 inclusive. It is associated with CWE-98 and received a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2025-12-18.
Unauthenticated attackers with network access can exploit this vulnerability despite requiring high attack complexity and no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, enabling attackers to include and potentially execute local files on the server through improper PHP include/require controls.
The Patchstack advisory provides details on this Local File Inclusion vulnerability specific to the WordPress Lione theme version 1.16, available at https://patchstack.com/database/Wordpress/Theme/lione/vulnerability/wordpress-lione-theme-1-16-local-file-inclusion-vulnerability?_s_id=cve. Security practitioners should consult this reference for mitigation guidance, such as applying available patches or theme updates.
Details
- CWE(s)