What is the CVSS score of CVE-2025-58897?

CVE-2025-58897 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fermentio Theme are affected by CVE-2025-58897?

A security flaw in the Axiomthemes Fermentio WordPress theme (versions 1.5.0 and earlier) enables unauthenticated remote attackers to read sensitive server files, including database credentials and…

How to fix or mitigate CVE-2025-58897?

Within 24 hours: Identify all WordPress installations using Axiomthemes Fermentio theme version 1.5.0 or earlier; disable the theme on all systems or implement WAF rules to block file inclusion attack patterns. Within 7 days: Remove the vulnerable theme entirely and deploy an alternative WordPress theme; audit web server logs for indicators of exploitation. Within 30 days: Verify no unauthorized file access occurred on affected systems, rotate database credentials and API keys, and monitor Axiomthemes for future security advisories.

Fermentio Theme CVE-2025-58897

EUVD-2025-210040 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 audit@patchstack.com

GHSA-4hm4-3rw4-fgx6

LFI Information Disclosure PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 14:33 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local File Inclusion.

This issue affects Fermentio: from n/a through 1.5.0.

AnalysisAI

Local File Inclusion in Axiomthemes Fermentio WordPress theme through version 1.5.0 allows remote unauthenticated attackers to include arbitrary local files via improperly controlled filename parameters in PHP include/require statements. The flaw is tracked under CWE-98 (PHP Remote File Inclusion) but per the description is exploitable as LFI, with no public exploit identified at time of analysis and high attack complexity reflected in the CVSS vector.

Technical ContextAI

Fermentio is a commercial WordPress theme distributed by Axiomthemes, typically used for brewery and beverage sites. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement), where user-controllable input is passed into PHP include() or require() constructs without sufficient sanitization. While the CWE class covers Remote File Inclusion (RFI), Patchstack's classification indicates exploitation in this case is limited to Local File Inclusion - meaning attackers can traverse and include files already present on the server (PHP source, configuration files, logs) rather than fetch remote payloads, which typically requires allow_url_include=On to be enabled in php.ini, an uncommon setting in modern deployments.

RemediationAI

No vendor-released patch identified at time of analysis based on the supplied data; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/fermentio/vulnerability/wordpress-fermentio-theme-1-5-0-local-file-inclusion-vulnerability should be monitored for an updated theme release beyond 1.5.0 from Axiomthemes. Until a fix ships, administrators should consider deactivating the Fermentio theme and switching to a maintained alternative (trade-off: visual/site rebuild work), or placing the site behind a WAF such as Patchstack's mU-plugin or Wordfence with rules blocking LFI-style traversal patterns (../, php://, file://) in query parameters (trade-off: may break legitimate parameters that contain path-like values). Additionally, set PHP's allow_url_include=Off and open_basedir to restrict include paths to the WordPress webroot to contain blast radius if exploitation is attempted.