CVE-2025-59555
Published: 22 October 2025
Summary
CVE-2025-59555 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Thememove Medizin. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the specific PHP Local File Inclusion flaw in the Medizin WordPress theme by patching to version 1.9.7 or later.
Validates user-supplied filenames for PHP include/require statements to prevent injection of malicious local file paths exploiting improper filename control.
Restricts filenames used in PHP include/require to an organization-defined whitelist of safe local files, blocking unauthorized file inclusion.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a PHP Local File Inclusion (LFI) in a public-facing WordPress theme, enabling remote exploitation for arbitrary file inclusion and execution, directly mapping to Exploit Public-Facing Application (T1190).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Medizin medizin allows PHP Local File Inclusion.This issue affects Medizin: from n/a through < 1.9.7.
Deeper analysisAI
CVE-2025-59555 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the ThemeMove Medizin WordPress theme. The issue impacts all versions of Medizin from n/a through those prior to 1.9.7. Published on 2025-10-22, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
Attackers can exploit this vulnerability over the network with no required privileges or user interaction, though it demands high attack complexity. Successful exploitation allows high-impact confidentiality, integrity, and availability violations, potentially enabling arbitrary file inclusion and execution of local files on the server.
The Patchstack advisory for this vulnerability in the WordPress Medizin theme recommends updating to version 1.9.7 or later, where the local file inclusion issue has been addressed.
Details
- CWE(s)