Cyber Resilience

CVE-2025-59555

High

Published: 22 October 2025

Published
22 October 2025
Modified
29 January 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-59555 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Thememove Medizin. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-59555 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the ThemeMove Medizin WordPress theme. The issue impacts all versions of Medizin from n/a through those prior to 1.9.7. Published on 2025-10-22, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.

Attackers can exploit this vulnerability over the network with no required privileges or user interaction, though it demands high attack complexity. Successful exploitation allows high-impact confidentiality, integrity, and availability violations, potentially enabling arbitrary file inclusion and execution of local files on the server.

The Patchstack advisory for this vulnerability in the WordPress Medizin theme recommends updating to version 1.9.7 or later, where the local file inclusion issue has been addressed.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a PHP Local File Inclusion (LFI) in a public-facing WordPress theme, enabling remote exploitation for arbitrary file inclusion and execution, directly mapping to Exploit Public-Facing Application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-22708Same vendor: Thememove
CVE-2025-14430Same vendor: Thememove
CVE-2025-54700Same vendor: Thememove
CVE-2025-14429Same vendor: Thememove
CVE-2025-22707Same vendor: Thememove
CVE-2025-58958Same vendor: Thememove
CVE-2025-54701Same vendor: Thememove
CVE-2025-58206Same vendor: Thememove
CVE-2025-60069Same vendor: Thememove
CVE-2025-59564Same vendor: Thememove

Affected Assets

thememove
medizin
≤ 1.9.7

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of the specific PHP Local File Inclusion flaw in the Medizin WordPress theme by patching to version 1.9.7 or later.

SI-10 Information Input Validation good match
prevent

Validates user-supplied filenames for PHP include/require statements to prevent injection of malicious local file paths exploiting improper filename control.

SI-9 Information Input Restrictions good match
prevent

Restricts filenames used in PHP include/require to an organization-defined whitelist of safe local files, blocking unauthorized file inclusion.

References