Fabric WordPress Theme
CVE-2025-58941
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote exploitation with high complexity due to LFI constraints and need for file control.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Fabric fabric allows PHP Local File Inclusion.This issue affects Fabric: from n/a through <= 1.5.0.
AnalysisAI
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Technical ContextAI
The vulnerability is a PHP Local File Inclusion (CWE-98) in the Fabric theme for WordPress. Improper validation of user-controlled input passed to include/require statements allows an attacker to specify a local file path, potentially loading malicious PHP code from server files like logs or temporary uploads. The CPE cpe:2.3:a:axiomthemes:fabric:*:*:*:*:*:wordpress:*:* confirms the affected component is the WordPress theme. Successful exploitation can escalate to RCE if file content is attacker-controllable.
RemediationAI
Upgrade the Fabric theme to a version beyond 1.5.0; the exact fix version is likely listed in the Patchstack advisory. If a patch is unavailable, disable the theme until remediation. As a compensating control, deploy a WAF rule to block directory traversal and file inclusion patterns targeting the theme's URL endpoints-this may introduce false positives. Restricting server file permissions and disabling dangerous PHP functions (e.g., allow_url_include) reduces impact but does not eliminate the vulnerability.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-98 – PHP Remote File Inclusion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today