What is the CVSS score of CVE-2025-58932?

CVE-2025-58932 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Prisma (WordPress theme) are affected by CVE-2025-58932?

The axiomthemes Prisma WordPress theme contains an unauthenticated remote file inclusion vulnerability (CVSS 8.1) affecting all versions through 1.10, exposing organizations using this theme to data…

How to fix or mitigate CVE-2025-58932?

Within 24 hours, audit all WordPress installations to identify and document any sites running the axiomthemes Prisma theme, and isolate affected environments from sensitive data access if possible. Within 7 days, either uninstall the Prisma theme and switch to an actively maintained alternative, or if business-critical, implement layered compensating controls including WAF rules to block file inclusion patterns, disable PHP execution in upload directories, and apply strict file permissions. Within 30 days, establish a process to monitor for vendor security patches or plan permanent theme replacement; ensure WordPress core and all plugins are updated to current versions, and conduct file integrity monitoring on affected servers.

Prisma (WordPress theme) CVE-2025-58932

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

PHP WordPress Information Disclosure LFI Prisma Wordpress Theme Axiomthemes

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable, unauthenticated PHP file inclusion (AV:N/PR:N/UI:N); AC:H reflects the specific path/staging conditions needed, and full C/I/A impact reflects potential file disclosure escalating to code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 16:54 vuln.today

CVE Published

Dec 18, 2025 - 08:16 cve.org

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Prisma prisma allows PHP Local File Inclusion.This issue affects Prisma: from n/a through <= 1.10.

AnalysisAI

PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.

Technical ContextAI

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement, i.e. PHP Remote/Local File Inclusion). It arises when a PHP include()/require() statement is fed a filename derived from attacker-controllable input without sufficient validation or path restriction, allowing the attacker to point the include at unintended local paths. In a WordPress theme context (CPE cpe:2.3:a:axiomthemes:prisma:*:*:*:*:*:wordpress:*:*), such flaws typically stem from theme template-loading logic or AJAX/handler parameters that accept a path or template name and pass it into an include call. Although CWE-98 is the PHP file-inclusion class, the description and Patchstack tags scope the concrete impact to Local File Inclusion (Information Disclosure), meaning local server files can be read and, where PHP content can be staged, executed.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed version is specified in the available data (affected through <= 1.10). Monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/prisma/vulnerability/wordpress-prisma-theme-1-10-local-file-inclusion-vulnerability?_s_id=cve) and the axiomthemes changelog for a release above 1.10 and upgrade as soon as one is published. In the interim, apply a virtual patch / WAF rule (e.g. Patchstack) to block path-traversal and file-inclusion patterns (../, php://, absolute paths, null bytes) on the theme's parameters; harden PHP by setting allow_url_include=Off and open_basedir to restrict include paths to the web root (side effect: may break plugins that rely on external includes); restrict or disable any theme AJAX/template-loading endpoints that accept a file or template parameter (side effect: could disable specific theme features); and if the theme is not essential, switch to a maintained theme. These controls reduce exposure but do not remove the underlying flaw.