Cyber Resilience

CVE-2025-58955

High

Published: 22 October 2025

Published
22 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-58955 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-58955 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and labeled as PHP Remote File Inclusion, which enables PHP Local File Inclusion in the Karzo WordPress theme developed by designervily. The issue affects Karzo versions from n/a through those prior to 2.6.

Unauthenticated attackers (PR:N) can exploit this vulnerability remotely over the network (AV:N) with high attack complexity (AC:H) and without requiring user interaction (UI:N). Successful exploitation can result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H), as reflected in its CVSS 3.1 base score of 8.1, with scope unchanged (S:U).

The Patchstack advisory details this as a Local File Inclusion vulnerability in the WordPress Karzo theme, addressed in version 2.6. Security practitioners should urge users to update to Karzo 2.6 or later to mitigate the issue.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Karzo karzo allows PHP Local File Inclusion.This issue affects Karzo: from n/a through < 2.6.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a PHP Local File Inclusion (LFI) in a public-facing WordPress theme, directly enabling exploitation of a public-facing web application (T1190) to access sensitive local files.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-28087Shared CWE-98
CVE-2025-23952Shared CWE-98
CVE-2026-32505Shared CWE-98
CVE-2025-48149Shared CWE-98
CVE-2025-60058Shared CWE-98
CVE-2025-49994Shared CWE-98
CVE-2026-24531Shared CWE-98
CVE-2025-67527Shared CWE-98
CVE-2025-69396Shared CWE-98
CVE-2025-62067Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the CVE by requiring timely patching of the vulnerable Karzo WordPress theme to version 2.6 or later where the PHP Local File Inclusion flaw is fixed.

SI-10 Information Input Validation good match
prevent

Requires validating user-supplied filenames and paths for PHP include/require statements to block malicious inputs enabling Local File Inclusion.

SC-7 Boundary Protection partial match
preventdetect

Boundary protection via web application firewalls or proxies can inspect and block network requests with path traversal payloads targeting the file inclusion vulnerability.

References