Prisma (WordPress theme) CVE-2025-58932

Exploitation requires reaching a Prisma theme code path that passes attacker-controlled input into a PHP include/require statement, per CWE-98 - i.e. a theme parameter (template name, file, or page path) that is not properly validated. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, and the vector is network-reachable (AV:N). What LIMITS exploitation: AC:H indicates non-trivial conditions must be met - the attacker must know or discover the vulnerable parameter and craft a valid path, and full code execution (versus mere file disclosure) further depends on the attacker's ability to stage includable PHP content (e.g. via log poisoning or an uploadable file), which is not guaranteed in default deployments. The flaw only applies to sites running the axiomthemes Prisma theme at version 1.10 or below.

Signals are mixed and lean toward a real-but-not-urgent priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, unauthenticated flaw with full CIA impact, driving the 8.1 High score, but the AC:H (high attack complexity) tempers ease of exploitation, implying specific conditions or non-trivial path manipulation are needed. Counterbalancing this, EPSS is very low at 0.08% (23rd percentile), the CVE is not in CISA KEV, and no public exploit or POC is identified - so exploitation is neither observed nor probabilistically likely in the near term. There is a mild internal tension worth noting: CWE-98 and the C:H/I:H/A:H rating imply potential code execution, while the tags emphasize 'Information Disclosure' / 'LFI', suggesting the confirmed impact is primarily file disclosure with RCE being conditional - verify the achievable impact against the Patchstack advisory. Net: patch when available, but this is a moderate priority rather than an emergency.

A remote unauthenticated attacker sends a crafted HTTP request to a Prisma theme endpoint that accepts a filename/template parameter, manipulating it to include a sensitive local file (e.g. wp-config.php or a previously staged PHP file) and thereby reading secrets or executing code. The AC:H rating means the attacker likely needs to satisfy specific path or configuration conditions, and no public POC currently exists to lower that bar.