CVE-2025-60058

High

Published: 18 December 2025

Published

18 December 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0042 32.9th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-60058 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-60058 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the DetailX WordPress theme developed by AncoraThemes. This flaw affects all versions of DetailX up to and including 1.10.0. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite requiring high attack complexity.

Unauthenticated attackers with network access can exploit this vulnerability remotely without user interaction. By manipulating filenames in PHP include/require statements, they can achieve local file inclusion, leading to high confidentiality (C:H), integrity (I:H), and availability (A:H) impacts, such as unauthorized access to sensitive files, arbitrary code execution, or denial of service.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/detailx/vulnerability/wordpress-detailx-theme-1-10-0-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion issue in DetailX version 1.10.0 and provides vulnerability data for mitigation guidance.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-204127

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DetailX detailx allows PHP Local File Inclusion.This issue affects DetailX: from n/a through <= 1.10.0.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme, exploitable remotely by unauthenticated attackers, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0