What is the CVSS score of CVE-2025-58924?

CVE-2025-58924 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Geya WordPress Theme are affected by CVE-2025-58924?

The ThemeRex Geya WordPress theme (versions ≤1.15) contains an unauthenticated file inclusion vulnerability (CVSS 8.1) with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2025-58924?

24 hours: Audit all WordPress installations for ThemeRex Geya version 1.15 or earlier; implement Web Application Firewall rules to block file inclusion attack patterns. 7 days: Replace the vulnerable theme with an alternative from a trusted source and validate functionality; if replacement is infeasible due to customizations, maintain strict WAF rules and file access controls. 30 days: Monitor Patchstack and WordPress.org advisories for patch releases; implement automated theme update processes to prevent recurrence.

Geya WordPress Theme CVE-2025-58924

EUVD-2025-210185 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Geya

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated theme endpoint (AV:N/PR:N/UI:N); AC:H reflects non-trivial request preconditions; LFI to wp-config enables full CIA compromise of the WordPress instance.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:07 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Geya <= 1.15 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Geya WordPress theme (versions up to and including 1.15) allows remote attackers to read or include arbitrary files on the server, leading to information disclosure and potential code execution via PHP file inclusion. Reported by Patchstack with no public exploit identified at time of analysis and no CISA KEV listing, though the high CVSS (8.1) reflects severe confidentiality, integrity and availability impact if the vulnerable path is reached.

Technical ContextAI

Geya is a commercial WordPress theme published by the ThemeRex group, identified by CPE cpe:2.3:a:themerex_group:geya. The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning user-controlled input is passed to a PHP include/require construct without adequate validation or path normalization. In WordPress themes this typically manifests in template loader endpoints, AJAX handlers, or shortcode renderers that accept a file or template parameter and resolve it against the server filesystem, enabling traversal sequences or absolute paths to pull in sensitive files such as wp-config.php or inject attacker-controlled PHP if combined with a writable upload path.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack record lists affected versions through 1.15 without naming a fixed release, so administrators should monitor the ThemeRex changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/geya/vulnerability/wordpress-geya-theme-1-15-local-file-inclusion-vulnerability) for an updated build and apply it as soon as it ships. Until a fix is available, deactivate and replace the Geya theme on production sites or place the WordPress install behind a WAF rule (Patchstack, Wordfence, or equivalent vPatch) that blocks requests containing traversal sequences or absolute paths in theme query parameters; if the theme must remain active, restrict access to /wp-content/themes/geya/ endpoints via webserver rules and harden open_basedir / disable allow_url_include in php.ini, accepting that these controls may break legitimate template loading and require regression testing.