What is the CVSS score of CVE-2025-58889?

CVE-2025-58889 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-58889?

The Axiomthemes Towny WordPress theme (version 1.16 and earlier) contains a local file inclusion vulnerability that could allow an unauthenticated attacker to read sensitive server files, potentially…

How to fix or mitigate CVE-2025-58889?

Within 24 hours, inventory all WordPress sites running Towny theme version 1.16 or earlier and verify no unauthorized file access has occurred. Disable the theme on production sites immediately if possible, replacing it with a non-vulnerable alternative. Within 7 days, implement a Web Application Firewall (WAF) rule to block requests containing path traversal patterns (e.g., '../' or 'file://') and restrict file inclusion via query parameters. Configure server-level restrictions to prevent the webserver from reading sensitive files outside the web root. Within 30 days, work with the theme vendor for a patch or plan a permanent migration to a supported theme. Monitor logs for any signs of attempted exploitation and ensure regular security scanning continues.

PHP CVE-2025-58889

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

PHP WordPress Information Disclosure LFI Towny Wordpress Theme Axiomthemes

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:58 vuln.today

CVE Published

Dec 18, 2025 - 08:15 cve.org

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Towny towny allows PHP Local File Inclusion.This issue affects Towny: from n/a through <= 1.16.

AnalysisAI

Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.