Karzo Theme CVE-2025-58955

Requires a request reaching a Karzo theme code path (versions from n/a through < 2.6) where attacker-controlled input flows into a PHP include/require statement. No authentication is required (PR:N) and no user interaction (UI:N), but the CVSS AC:H indicates exploitation is NOT trivial against a default install - it likely depends on a specific reachable parameter, theme feature, or configuration state rather than working universally. Limiting factors: the affected component is a specific premium WordPress theme (must be installed and active), full impact as code execution (rather than mere file read) typically requires an additional primitive such as a writable/controllable local file (e.g., log poisoning), and the high attack complexity reduces the likelihood of reliable, scalable exploitation.

This is a PHP file inclusion flaw (CWE-98) in the WordPress 'Karzo' theme, scored CVSS 8.1 with vector AV:N/AC:H/PR:N/UI:N. The combination of network vector and no required privileges (PR:N) means remote, unauthenticated attackers can reach it, which raises its nominal severity. However, the HIGH attack complexity (AC:H) indicates non-trivial preconditions or special circumstances are needed to succeed, which tempers the real-world exploitability. The EPSS score is low at 0.52% (42nd percentile), suggesting no observed mass-scanning or widespread exploitation activity. There is NO CISA KEV listing and NO public proof-of-concept referenced - only a Patchstack advisory. No SSVC decision data was provided in the input. Signals are therefore broadly consistent and point to a genuinely-remote but not-yet-actively-exploited issue: the high CVSS is driven by the unauthenticated network vector and full C/I/A impact, while the low EPSS and AC:H moderate the practical urgency. Note a nomenclature tension in the source data: the CWE and title reference 'PHP Remote File Inclusion' while the description explicitly states the impact is 'PHP Local File Inclusion' - treat the realistic impact as LFI (local file read, with possible escalation to code execution via inclusion) and verify RFI applicability with the vendor.

A remote, unauthenticated attacker crafts a request to a vulnerable Karzo theme endpoint that passes attacker-influenced input into a PHP include/require statement, causing the server to include and execute a local file (e.g., for configuration disclosure or, if combined with a writable/log file, code execution). Because attack complexity is HIGH, success likely depends on specific theme configuration or a reachable vulnerable parameter. No public exploit code is referenced at time of analysis.