CVE-2025-58885: 
NixOS vulnerability analysis and mitigation

CVE-2025-58885 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes Pathfinder WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Pathfinder theme through 1.16 and allows unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on July 24, 2025, and published by Patchstack on August 23, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filenames used in PHP include/require statements within the Pathfinder theme (CWE-98), which allows user-supplied input to influence which local file is included and executed. An unauthenticated attacker can send a crafted network request that manipulates the filename parameter, causing the PHP interpreter to include arbitrary local files from the server's filesystem. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read and potentially execute arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), application source code, and system files like /etc/passwd. This can lead to full database compromise, credential theft, and further lateral movement within the hosting environment. The vulnerability has high impact across confidentiality, integrity, and availability dimensions (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. No threat actor attribution or CISA KEV catalog listing has been identified. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale, making timely patching important (Patchstack).

No official patch from AncoraThemes has been released as of the publication date; the Pathfinder theme versions through 1.16 remain vulnerable. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is available. Administrators should immediately update the Pathfinder theme if a patched version above 1.16 becomes available, or consider replacing the theme. Additional mitigations include implementing Web Application Firewall (WAF) rules to detect and block LFI patterns, enforcing strict input validation on file inclusion operations, and reviewing server logs for suspicious file access patterns (Patchstack).