CVE-2025-2558: 
WordPress vulnerability analysis and mitigation

CVE-2025-2558 affects The-wound WordPress theme through version 0.0.1. The vulnerability was discovered by Aly Khaled and was publicly disclosed on April 3, 2025. This security flaw exists in the theme's parameter validation mechanism for path generation (WPScan).

The vulnerability is classified as a Local File Inclusion (LFI) vulnerability with a CVSS v3.1 base score of 8.6 (HIGH). The attack vector is characterized by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is mapped to CWE-22 and falls under the OWASP Top 10 category A1: Injection (WPScan, NVD).

The vulnerability allows unauthenticated users to perform Local File Inclusion (LFI) attacks and download arbitrary files from the server. This can lead to exposure of sensitive server-side files and potential information disclosure (WPScan).

A proof of concept exists demonstrating how attackers can exploit this vulnerability by accessing a specific URL pattern: https://example.com/wp-content/themes/the-wound/force_download.php?file=php://filter/convert.base64-encode/resource=force_download.php. The response contains base64-encoded content of the target file, which can be decoded to view the source code (WPScan).

Currently, there is no known fix available for this vulnerability. Users of The-wound WordPress theme version 0.0.1 or earlier should consider using alternative themes until a security patch is released (WPScan).