What is the CVSS score of CVE-2025-58953?

CVE-2025-58953 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Joly WordPress Theme are affected by CVE-2025-58953?

The Joly WordPress theme by ThemeREX (versions up to 1.22.0) contains an unauthenticated local file inclusion vulnerability with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2025-58953?

Within 24 hours: Conduct inventory of all WordPress installations to identify any systems using Joly theme versions up to 1.22.0; immediately disable the theme if deployed. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking local file inclusion patterns and implement input validation controls; contact ThemeREX for patch status and upgrade path. Within 30 days: Rotate all database credentials and WordPress authentication keys potentially exposed; conduct security audit of affected systems for evidence of exploitation; implement file access monitoring for sensitive configuration files.

Joly WordPress Theme CVE-2025-58953

EUVD-2025-210219 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Joly

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Network-reachable unauthenticated LFI; AC:L since typical WordPress theme LFIs require only a crafted request; primary impact is file disclosure (C:H), limited integrity (I:L) via possible log/session poisoning, no inherent availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:47 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.

AnalysisAI

Unauthenticated Local File Inclusion affects the Joly WordPress theme by ThemeREX in versions up to and including 1.22.0, allowing remote attackers without credentials to coerce the PHP application into including arbitrary local files. Successful exploitation can disclose sensitive configuration (such as wp-config.php containing database credentials and auth keys) and, depending on server configuration, escalate to remote code execution via log poisoning or session file inclusion. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The Joly theme is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:joly). The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which covers PHP include()/require() statements that incorporate attacker-influenced filename parameters without proper validation, allowing path traversal sequences (../) or absolute paths to redirect file inclusion. In WordPress themes, this typically manifests in AJAX handlers, template loaders, or shortcode processors that accept a file or template parameter from HTTP input and pass it directly to a PHP include construct. The Patchstack tagging as PHP/LFI/Information Disclosure indicates the primary impact pathway is reading server-local files through the PHP interpreter.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version greater than 1.22.0 is not independently confirmed from the available data, so administrators should consult the Patchstack record at https://patchstack.com/database/wordpress/theme/joly/vulnerability/wordpress-joly-theme-1-22-0-local-file-inclusion-vulnerability and the ThemeREX vendor channel for the exact fixed release before upgrading. Until a confirmed patched version is installed, compensating controls include deploying a WordPress-aware WAF rule (Patchstack, Wordfence, or ModSecurity OWASP CRS) to block path-traversal sequences and absolute paths in query/POST parameters targeting theme endpoints; restricting PHP open_basedir to the WordPress document root to prevent reading /etc/passwd-class files and arbitrary system paths; and disabling allow_url_include in php.ini (typically already off) to prevent escalation to RFI. Trade-offs: WAF rules can break legitimate template parameters and require tuning, and tightening open_basedir may break plugins that legitimately read outside the webroot. Rotate any secrets in wp-config.php (DB password, AUTH_KEY, SECURE_AUTH_KEY, NONCE_KEY, etc.) if you have reason to believe the site was scanned while vulnerable.