What is the CVSS score of CVE-2025-58995?

CVE-2025-58995 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-58995?

CVE-2025-58995 is a local file inclusion vulnerability in Leblix WordPress theme versions up to 2.4 that allows unauthenticated remote attackers to read and potentially execute arbitrary files on…

How to fix or mitigate CVE-2025-58995?

Within 24 hours: Identify all WordPress installations using Leblix theme versions ≤2.4 via wp-content/themes directory inspection; disable or deactivate the theme immediately and switch to an alternative theme. Within 7 days: Review access logs for /wp-content/themes/leblix/ paths with suspicious query parameters; audit exposed files (wp-config.php, .env, debug.log) for unauthorized access; reset database credentials and API keys if compromise is suspected. Within 30 days: Remove Leblix theme completely from all installations; implement Web Application Firewall (WAF) rules to block file inclusion patterns; conduct security audit of theme update procedures to prevent future vulnerable plugin/theme adoption.

PHP CVE-2025-58995

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creatives_Planet Leblix leblix allows PHP Local File Inclusion.This issue affects Leblix: from n/a through <= 2.4.

AnalysisAI

Local File Inclusion (LFI) in Leblix WordPress theme versions up to 2.4 allows remote unauthenticated attackers to include and execute arbitrary local files through improper filename control in PHP include/require statements. Despite the network attack vector (AV:N), exploitation requires high complexity conditions (AC:H), potentially involving specific configuration states or input validation bypasses. EPSS score of 0.04% (11th percentile) indicates low observed exploitation probability in the wild, and no CISA KEV listing confirms this remains a theoretical rather than actively exploited vulnerability. The vulnerability permits information disclosure through file content exposure and potentially code execution if attackers can chain LFI with other weaknesses like log poisoning or PHP wrapper abuse.