CVE-2025-59558
Published: 22 October 2025
Summary
CVE-2025-59558 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Thememove Billey. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates this LFI vulnerability by requiring timely patching of the affected Billey theme to version 2.1.6 or later.
Information input validation enforces proper sanitization and validation of filenames used in PHP include/require statements, preventing local file inclusion exploits.
Vulnerability monitoring and scanning identifies known issues like CVE-2025-59558 in WordPress themes, enabling proactive remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress theme enables T1190 for initial exploitation; facilitates arbitrary local file reads for T1005 data collection, T1083 file discovery, and T1552.001 credential access from files like wp-config.php.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.
Deeper analysisAI
CVE-2025-59558 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the ThemeMove Billey WordPress theme. This flaw affects Billey versions from n/a through those prior to 2.1.6.
Unauthenticated remote attackers can exploit the vulnerability over the network (AV:N) without user interaction (UI:N) and with no privileges required (PR:N), though it demands high attack complexity (AC:H). Exploitation within unchanged scope (S:U) can result in high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), yielding a CVSS v3.1 base score of 8.1.
The Patchstack advisory details the Local File Inclusion vulnerability in the WordPress Billey theme and indicates it is addressed in version 2.1.6. Mitigation involves updating affected Billey installations to 2.1.6 or later.
Details
- CWE(s)