CVE-2025-58913: 
WordPress vulnerability analysis and mitigation

CVE-2025-58913 is a Local File Inclusion (LFI) vulnerability in the CactusThemes VideoPro WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the VideoPro theme up to and including 2.3.8.1, allowing unauthenticated remote attackers to include arbitrary local files via improperly controlled PHP include/require statements. The vulnerability was reported on September 18, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and published by Patchstack on January 8, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Github Advisory).

The root cause is CWE-98: the VideoPro theme fails to properly restrict or sanitize user-supplied input before passing it to PHP include or require statements, enabling an attacker to manipulate the filename parameter to reference arbitrary files on the server's filesystem. Because no authentication is required and the attack vector is network-accessible, an unauthenticated attacker can craft a malicious HTTP request that causes the PHP interpreter to include sensitive local files (e.g., configuration files containing database credentials). The attack complexity is rated High, suggesting some precondition or bypass technique is required, but no user interaction is needed (Patchstack, Github Advisory).

Successful exploitation allows an unauthenticated attacker to read arbitrary files from the web server's filesystem, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. Depending on server configuration, LFI may be chained with other techniques (e.g., log poisoning or uploaded file inclusion) to achieve remote code execution, resulting in full system compromise. The vulnerability impacts confidentiality, integrity, and availability — all rated High in the CVSS scoring (Patchstack).

There is no publicly known proof-of-concept exploit or evidence of active in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.054% (17th percentile), indicating a low current probability of exploitation within the next 30 days. However, Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the CactusThemes VideoPro theme version ≤ 2.3.8.1 using tools like WPScan, Shodan, or Google dorks targeting theme-specific files (e.g., inurl:/wp-content/themes/videopro/).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP responses to locate the endpoint and parameter that is passed unsanitized to a PHP include or require statement.
3. Craft malicious request: Send a crafted HTTP GET or POST request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) using path traversal sequences.
4. Extract sensitive data: Review the HTTP response for the contents of the included file, which may expose database credentials, secret keys, or other configuration data from wp-config.php.
5. Escalate (optional): If the server configuration permits, chain the LFI with log poisoning or PHP session file inclusion to achieve remote code execution and full server compromise (Patchstack).

• Network: Unusual HTTP requests to VideoPro theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body; repeated requests to theme PHP files from unfamiliar IP addresses.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal patterns targeting VideoPro theme files; PHP error logs referencing unexpected file inclusion paths or failed to open stream errors for sensitive system files.
• File System: Unexpected new PHP files or web shells in the WordPress uploads directory or theme directory; modification timestamps on theme files that do not align with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) if LFI has been escalated to RCE via log poisoning or similar techniques.

As of the time of publication, no official patch from CactusThemes has been released for the VideoPro theme; the Patchstack advisory notes "No official patch available" (Patchstack). Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is available. Site administrators should consider disabling or replacing the VideoPro theme if a patched version is not yet available, restrict web server file permissions to limit readable files, and implement a Web Application Firewall (WAF) rule to block path traversal patterns in HTTP requests (Github Advisory).

The vulnerability was covered in the Wordfence Intelligence Weekly WordPress Vulnerability Report for January 5–11, 2026, indicating it received attention from the broader WordPress security community shortly after disclosure (Wordfence Blog). The CISA vulnerability bulletin for the week of April 6, 2026 also referenced this CVE, reflecting its inclusion in broader government cybersecurity tracking (CISA Bulletin). Social media activity was limited, with brief mentions on Mastodon and automated CVE notification accounts on Nitter.