What is the CVSS score of CVE-2025-58954?

CVE-2025-58954 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of HomeRoofer Theme are affected by CVE-2025-58954?

The ThemeRex HomeRoofer WordPress theme (through version 2.11.0) contains an unauthenticated remote file inclusion vulnerability that enables attackers to read arbitrary server files, including…

How to fix or mitigate CVE-2025-58954?

Within 24 hours: Inventory all WordPress installations using ThemeRex HomeRoofer theme through version 2.11.0. Within 7 days: Immediately deactivate and remove the vulnerable theme, or deploy Web Application Firewall rules blocking path traversal patterns (e.g., /../, file:// URIs, wp-config.php requests) and restrict PHP allow_url_include and allow_url_fopen directives. Within 30 days: Monitor official Patchstack and HomeRoofer vendor channels for security patch; execute migration plan to alternative theme provider if patch is not released.

HomeRoofer Theme CVE-2025-58954

EUVD-2025-210220 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Homeroofer

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects path-knowledge and wrapper preconditions; C:H for arbitrary file read, but I/A only Low because integrity/availability impact requires additional chaining not guaranteed by pure LFI.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:47 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex HomeRoofer WordPress theme through version 2.11.0 allows remote attackers to include and read arbitrary local files on the server, potentially leading to source code disclosure, credential theft from wp-config.php, and in some PHP configurations remote code execution. The flaw is reachable without authentication over HTTP, and no public exploit has been identified at time of analysis though Patchstack has catalogued the issue in their WordPress vulnerability database. No CISA KEV listing or EPSS data was supplied in the source intelligence.

Technical ContextAI

HomeRoofer is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:homeroofer). The CWE-98 classification ('Improper Control of Filename for Include/Require Statement in PHP Program', commonly called PHP Remote/Local File Inclusion) indicates that user-controlled input is being passed into a PHP include(), require(), include_once(), or require_once() statement without sufficient sanitization or allow-list validation. In WordPress themes this pattern typically appears in AJAX handlers, shortcode renderers, or template loaders that accept a 'file', 'template', 'view', or similar parameter and concatenate it into a filesystem path, allowing traversal sequences like '../' to break out of the intended directory.

RemediationAI

No vendor-released patched version is independently confirmed in the supplied intelligence beyond the implication that 2.11.0 and earlier are vulnerable; administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/homeroofer/vulnerability/wordpress-homeroofer-theme-2-11-0-local-file-inclusion-vulnerability for the fixed release once published by ThemeRex and upgrade immediately when available. Until a fix is installed, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) blocking requests to HomeRoofer theme endpoints containing path traversal sequences ('../', encoded variants, null bytes, 'php://', 'file://') - note this may break legitimate theme AJAX calls if rules are too broad and should be tested in detect-only mode first. Hardening php.ini with open_basedir restricted to the WordPress document root and disable_functions limiting dangerous primitives reduces blast radius but does not prevent disclosure of in-scope files such as wp-config.php; as a last resort, deactivate the HomeRoofer theme and switch to a default theme, accepting the obvious site-presentation impact.