Lighthouse (WordPress theme) CVE-2025-58902

Exploitation targets the Lighthouse theme's PHP include/require path handling and requires the vulnerable theme (<= 1.2.12) to be installed and active on a network-reachable WordPress site; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The limiting factor is CVSS AC:H - success depends on specific conditions such as the vulnerable endpoint/parameter being reachable and the server allowing the traversal or PHP-wrapper technique used; full integrity/availability (code-execution) impact further depends on non-default server settings such as allow_url_include being enabled or attacker-writable content being includable, so a hardened server may limit the outcome to file disclosure only.

Signals are mixed. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1 High) indicates a network-reachable, unauthenticated, no-user-interaction flaw with full impact, but the AC:H metric signals that exploitation depends on specific, non-trivial conditions rather than a trivial one-shot request. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The vulnerability is NOT in CISA KEV and no POC/exploit reference is included, so this should be treated as 'no public exploit identified at time of analysis' - a real-but-not-emergency issue. The I:H/A:H ratings are somewhat optimistic for a pure LFI; they are justified only if the inclusion can reach writable/attacker-supplied content (true RFI) or PHP wrappers enabling execution - for a read-only LFI the practical impact is primarily confidentiality (C:H). Verify the actual sink with the Patchstack advisory before assuming code execution.

An unauthenticated attacker sends a crafted HTTP request to the vulnerable theme endpoint with a manipulated file/path parameter using directory traversal or a PHP wrapper, causing the theme to include an unintended file and return the contents of wp-config.php (exposing database credentials and secret keys). If the server permits inclusion of attacker-controlled or uploaded content, the same primitive can be leveraged toward PHP code execution. No public POC is referenced, and the CVSS AC:H rating implies the attacker must satisfy specific conditions to reliably trigger the include.