CVE-2025-58955: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-58955) was discovered in the designervily Karzo WordPress theme affecting versions prior to 2.6. The vulnerability was disclosed on October 12, 2025, and involves improper control of filename for include/require statements in PHP programs (NVD, Wordfence Intel).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and has received a CVSS v3.1 base score of 8.1 (High). The attack vector is network-based (AV:N) with high attack complexity (AC:H), requiring no privileges (PR:N) or user interaction (UI:N), affecting the system scope as unchanged (S:U) with potential for high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) (NVD).

The vulnerability allows for PHP Local File Inclusion, which could potentially enable attackers to access sensitive files on the affected system. The high CVSS score of 8.1 indicates significant potential impact on system security, particularly affecting confidentiality, integrity, and availability of the affected WordPress installations (NVD).

Users are advised to upgrade to Karzo version 2.6 or later, which contains patches for this vulnerability (Wordfence Intel).