CVE-2025-58958: 
WordPress vulnerability analysis and mitigation

CVE-2025-58958 is a PHP Local File Inclusion (LFI) vulnerability in the ThemeMove SmilePure WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the SmilePure theme prior to 1.8.5 and was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on June 30, 2025, with public disclosure on October 22, 2025 via Patchstack. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assigned by Patchstack (Patchstack Advisory).

The root cause is improper control of filename parameters used in PHP include/require statements within the SmilePure theme (CWE-98). An attacker can manipulate user-supplied input that is passed directly into file inclusion functions, causing the server to include arbitrary local files. This is a network-accessible attack requiring no authentication and no user interaction, though it has high attack complexity. No public proof-of-concept exploit code has been identified at this time (Patchstack Advisory).

Successful exploitation allows an unauthenticated remote attacker to read sensitive local files on the server, including configuration files that may contain database credentials, API keys, or other secrets. Depending on server configuration, an attacker may also be able to execute arbitrary PHP code by including malicious files (e.g., via log poisoning or uploaded file paths), potentially leading to full website compromise. The vulnerability affects confidentiality, integrity, and availability — all rated High — making it suitable for use in mass-exploit campaigns targeting WordPress sites (Patchstack Advisory).

There is no known public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has classified it as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns against WordPress sites (Patchstack Advisory).

1. Reconnaissance: Identify WordPress sites using the SmilePure theme (versions < 1.8.5) via web crawlers, Wappalyzer fingerprinting, or by checking theme-specific file paths (e.g., /wp-content/themes/smilepure/).
2. Identify vulnerable parameter: Locate a theme endpoint or page that accepts a filename or path parameter passed to a PHP include/require function without proper sanitization.
3. Craft LFI payload: Submit a crafted HTTP request with a manipulated file path parameter (e.g., ?file=../../../../etc/passwd or ?template=../../../../wp-config.php) to traverse directories and include sensitive files.
4. Extract sensitive data: Review the server response for the contents of included files such as /etc/passwd, wp-config.php (containing database credentials), or other configuration files.
5. Escalate (if possible): Attempt code execution by including a previously uploaded file containing PHP code (e.g., via WordPress media upload) or by poisoning server logs and including the log file (Patchstack Advisory).

• Network: HTTP requests to WordPress pages using the SmilePure theme containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; unusual GET/POST requests with file path patterns targeting sensitive files like wp-config.php or /etc/passwd.
• Logs: Web server access logs showing requests with encoded or plain directory traversal strings in URL parameters; repeated 200 OK responses to requests containing file path parameters that should not normally accept such input.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory (/wp-content/uploads/) that may be used for LFI-to-RCE escalation.
• Application: Unexpected output of system file contents (e.g., database credentials, OS user listings) appearing in rendered WordPress pages.

The primary remediation is to update the SmilePure theme to version 1.8.5 or later, which contains the fix for this vulnerability. Patchstack has also issued a virtual patch (mitigation rule) for subscribers that blocks exploitation attempts until the theme is updated. As general hardening measures, administrators should implement strict input validation for any file inclusion mechanisms, use allow-lists for permitted file paths, and avoid passing user-supplied input directly to PHP include/require functions (Patchstack Advisory).