Algenix
CVE-2025-58803
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local file inclusion only achieves read access; no direct write or DoS impact
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Algenix algenix allows PHP Local File Inclusion.This issue affects Algenix: from n/a through <= 1.0.
AnalysisAI
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
Technical ContextAI
The vulnerability stems from improper control of filenames passed to PHP include/require statements (CWE-98), allowing attackers to manipulate file paths. The affected product is the ‘Algenix’ WordPress theme by axiomthemes (CPE: cpe:2.3:a:axiomthemes:algenix:*:*:*:*:*:wordpress:*:*). Such flaws typically occur when user input is directly used in include() or require() without sanitisation, enabling directory traversal or use of PHP wrappers to access local files like wp-config.php. Although the CWE is ‘PHP Remote File Inclusion’, the advisory states the actual impact is local file inclusion, meaning the attacker can read but not write or execute remote code directly via this vector, though sensitive information disclosure may facilitate further attacks.
RemediationAI
No vendor-released patch has been identified. The only affected version is 1.0; users should immediately switch to a different theme or update to a patched version if axiomthemes releases one (monitor the Patchstack reference for updates). As a temporary workaround, disable the Algenix theme entirely. If the theme must remain active, deploy a Web Application Firewall rule that blocks requests containing directory traversal sequences (e.g., ‘../’) or PHP wrappers (e.g., ‘php://’) aimed at theme endpoints. Be aware that such rules may interfere with legitimate admin queries that use similar patterns. Consider hardening PHP by disabling allow_url_include and setting open_basedir restrictions to limit file inclusion scope.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-98 – PHP Remote File Inclusion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today