ThemeMove Billey CVE-2025-59558

Requires the ThemeMove Billey WordPress theme at a version from initial release through any version below 2.1.6 to be installed and active. Exploitation targets a theme code path that passes attacker-influenced input into a PHP include/require statement; the CVSS AC:H indicates a non-trivial precondition (such as a specific request format, encoding, or environment state) limits reliable exploitation. No authentication is required per PR:N and no user interaction per UI:N, but realistic impact depends on which local files are reachable and whether an includable attacker-controlled file exists on the host to achieve code execution rather than mere disclosure. Sites updated to 2.1.6 or later are not affected.

This is a PHP Local File Inclusion flaw (CWE-98) in the ThemeMove 'Billey' WordPress theme, versions up to and including 2.1.5 (fixed in 2.1.6). The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) describes a network-reachable, unauthenticated issue but with HIGH attack complexity, which tempers the raw score - AC:H implies a non-trivial precondition or race/encoding requirement rather than a trivially repeatable request. The EPSS score is low (0.53%, 43rd percentile), and the vulnerability is NOT in CISA KEV and has no public exploit identified, so all three real-world-exploitation signals (EPSS, KEV, POC) point to low current exploitation activity despite the high CVSS. Note a naming/classification tension: the CWE and title reference 'PHP Remote File Inclusion' while the Patchstack description explicitly states the realized impact is 'PHP Local File Inclusion' - treat this as LFI (inclusion of local paths), which typically yields source/secret disclosure and can escalate to code execution if an attacker-controlled file can be referenced. Net assessment: a genuinely serious flaw for sites running the affected theme, but currently a moderate rather than urgent priority given no exploitation evidence, high attack complexity, and a niche commercial-theme footprint - prioritize patching but it is not a mass-exploitation emergency at this time.

A remote, unauthenticated attacker crafts a request to a vulnerable Billey theme endpoint that passes attacker-influenced input into a PHP include/require path, causing the application to include a local file. Successful inclusion can disclose sensitive files (e.g., configuration, credentials) or execute PHP if a controllable local file can be referenced. No public proof-of-concept is currently available, and the HIGH attack complexity suggests exploitation requires a specific precondition rather than a simple one-shot request.