What is the CVSS score of CVE-2025-58707?

CVE-2025-58707 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Axiomthemes Spin are affected by CVE-2025-58707?

Axiomthemes Spin WordPress theme (versions ≤1.8) contains a Local File Inclusion vulnerability (CVSS 8.1) enabling attackers to read sensitive configuration files, including database credentials and…

How to fix or mitigate CVE-2025-58707?

24 hours: Inventory all WordPress installations using Axiomthemes Spin ≤1.8; verify active deployment and criticality. 7 days: Deactivate the vulnerable theme or implement Web Application Firewall rules blocking file inclusion patterns (e.g., path traversal, include/require parameter injection); apply WordPress security hardening (disable file editing, restrict file permissions). 30 days: Remove Spin ≤1.8 entirely and migrate to alternative theme; monitor Axiomthemes advisories for patched version release; apply patch immediately upon availability (track vendor release version number).

Axiomthemes Spin CVE-2025-58707

EUVD-2025-210039 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 audit@patchstack.com

GHSA-78v5-q9xf-23vc

LFI Information Disclosure PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 14:31 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion.

This issue affects Spin: from n/a through 1.8.

AnalysisAI

Local File Inclusion in the Axiomthemes Spin WordPress theme (versions up to and including 1.8) allows remote attackers to coerce the PHP runtime into including arbitrary local files via an unsanitized filename parameter passed to an include/require statement. Successful exploitation can disclose sensitive configuration data (such as wp-config.php) and, depending on server configuration, escalate into remote code execution by including attacker-controlled content. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The Spin theme is a commercial WordPress theme produced by Axiomthemes and distributed for use on PHP-based WordPress sites. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), in which a value derived from user input flows into a PHP include, include_once, require, or require_once statement without sufficient validation against an allow-list of permitted files. Although the CWE class is named 'PHP Remote File Inclusion,' the issue here manifests as Local File Inclusion because typical hardened PHP installations have allow_url_include disabled, restricting attackers to files already present on the server. Patchstack categorized the issue under PHP, Information Disclosure, and LFI, which is consistent with the include-statement abuse pattern affecting WordPress themes.

RemediationAI

No vendor-released patch identified at time of analysis based on the supplied references; the Patchstack entry (https://patchstack.com/database/wordpress/theme/spin/vulnerability/wordpress-spin-theme-1-8-local-file-inclusion-vulnerability) should be monitored for an updated theme release beyond 1.8, and site owners should subscribe to Axiomthemes update notifications and upgrade as soon as a fixed version is published. Until a patch is available, compensating controls include deactivating and removing the Spin theme on sites that can switch to another theme (eliminates exposure but changes site appearance), placing a WAF rule in front of the site that blocks requests containing path-traversal sequences such as '../', null bytes, or absolute paths in query parameters handled by the theme (may produce false positives on legitimate parameters), tightening PHP settings by ensuring allow_url_include=Off and setting a restrictive open_basedir to the WordPress root (prevents traversal outside the site but can break plugins that legitimately access files elsewhere), and restricting filesystem permissions so the PHP user cannot read sensitive files such as wp-config.php from a parent directory (requires careful permission engineering to avoid breaking WordPress core functionality).