CVE-2025-2558

The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

2.36% chance of exploitation in the next 30 days, 83th percentile

Nuclei

high · CWE-98

Published

2025-04-24

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2558.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2025-25579
• CVE-2025-2560
• CVE-2025-25570
• CVE-2025-2561
• CVE-2025-2557
• CVE-2025-25612