Algenix CVE-2025-58803

The theme must be installed and active on a WordPress site. No authentication is required, but attack complexity is high - the attacker must craft a valid inclusion path that bypasses any sanitisation or directory traversal protections, possibly relying on specific PHP configurations (e.g., wrapper support). The vulnerability allows reading local files only; it does not directly enable code execution or data modification without chaining additional vulnerabilities. The high complexity may stem from the need to know the exact path or to circumvent input filtering, which reduces the risk of automated widespread exploitation.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) scores 8.1, suggesting high impact on confidentiality, integrity, and availability. However, local file inclusion alone normally provides only read access (confidentiality impact), making the integrity and availability ratings overly pessimistic unless combined with separate code execution techniques. The EPSS exploitation probability is 0.08%, indicating very low real‑world risk. No CISA KEV entry exists, and no public exploit code has been identified, so exploitation status remains ‘no public exploit identified at time of analysis’. The SSVC decision would be ‘slow track’ given no active exploitation and low EPSS. While the vulnerability is technically accessible over the network without authentication, its high attack complexity and the narrow impact of local file inclusion significantly reduce urgency. CVSS suggests network vector but the actual exploitation may require specific PHP configurations or file permissions, although this is not explicitly stated - verify with vendor if further details emerge.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint of the Algenix theme, supplying a parameter that includes a file path. The request forces PHP to include a sensitive local file, such as /etc/passwd or the WordPress configuration file, leading to information disclosure.