CVE-2025-2558: 
WordPress vulnerability analysis and mitigation

CVE-2025-2558 affects The-wound WordPress theme through version 0.0.1. The vulnerability was discovered by Aly Khaled and was publicly disclosed on April 3, 2025. This security flaw exists in the theme's parameter validation mechanism for path generation (WPScan).

The vulnerability is classified as a Local File Inclusion (LFI) vulnerability with a CVSS v3.1 base score of 8.6 (HIGH). The attack vector is characterized by CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is mapped to CWE-22 and falls under the OWASP Top 10 category A1: Injection (WPScan, NVD).

The vulnerability allows unauthenticated users to perform Local File Inclusion (LFI) attacks and download arbitrary files from the server. This can lead to exposure of sensitive server-side files and potential information disclosure (WPScan).

Currently, there is no known fix available for this vulnerability. Users of The-wound WordPress theme version 0.0.1 or earlier should consider using alternative themes until a security patch is released (WPScan).