What is the CVSS score of CVE-2025-58952?

CVE-2025-58952 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Neuronet WordPress Theme are affected by CVE-2025-58952?

The ThemeREX Neuronet WordPress theme has a critical security flaw that enables remote attackers to access sensitive server files including database credentials and configuration data without…. A patch is available.

How to fix or mitigate CVE-2025-58952?

24 hours: Disable the ThemeREX Neuronet theme on all WordPress installations; restrict web server permissions to theme directories. 7 days: Verify availability of patched version 1.14.0 with vendor; prepare migration to alternative themes. 30 days: Deploy vendor patch if released; implement WAF rules blocking path traversal patterns; audit logs for exploitation attempts.

Neuronet WordPress Theme CVE-2025-58952

EUVD-2025-210218 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Neuronet

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Unauthenticated network LFI in a WordPress theme justifies AV:N/PR:N/UI:N; AC:H reflects PHP/config preconditions for impact beyond file read; C:H for arbitrary file disclosure, I/A:L since RCE escalation is conditional.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:16 EUVD

Analysis Generated

Jun 17, 2026 - 12:48 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Neuronet WordPress theme before version 1.14.0 allows remote attackers to coerce the PHP runtime into including arbitrary files via untrusted input reaching an include/require statement. The flaw is reachable without authentication or user interaction, but CVSS marks attack complexity as High, suggesting non-trivial preconditions for full exploitation. No public exploit identified at time of analysis, and the issue is not on the CISA KEV list.

Technical ContextAI

Neuronet is a commercial WordPress theme published by ThemeREX (CPE cpe:2.3:a:themerex:neuronet). The root cause is CWE-98, improper control of filename for an include/require statement in a PHP program, in which user-controlled input (typically a request parameter) is concatenated into a PHP include path. In WordPress themes this pattern frequently appears in template loaders, AJAX handlers, or shortcode renderers that resolve a template name from $_GET/$_POST without normalizing the path or restricting it to a whitelist, allowing traversal sequences or alternate stream wrappers to load attacker-chosen files served by the host filesystem.

RemediationAI

Upgrade the Neuronet theme to version 1.14.0 or later, which Patchstack identifies as the fixed release; the advisory at https://patchstack.com/database/wordpress/theme/neuronet/vulnerability/wordpress-neuronet-theme-1-14-0-local-file-inclusion-vulnerability is the authoritative reference. If immediate patching is not possible, place a WAF rule (Patchstack, Wordfence, or ModSecurity) in front of the site to block requests containing path traversal sequences (../, ..%2f, php://, file://) targeting theme PHP endpoints, accepting the trade-off that legitimate parameters carrying dots or slashes may be blocked. As a stronger compensating control, temporarily switch the active theme to a default WordPress theme (Twenty Twenty-Four/Five) until the upgrade can be staged - this fully removes the vulnerable code path but breaks the site's appearance and any theme-specific shortcodes. Hardening php.ini with allow_url_include=Off and open_basedir restrictions further limits the blast radius if inclusion of remote or out-of-webroot files is attempted.