CVE-2025-58967: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability was discovered in ThemeMove's Businext WordPress theme, identified as CVE-2025-58967. The vulnerability affects versions prior to 2.4.4 and was publicly disclosed on September 15, 2025. The issue stems from improper control of filename for include/require statements in PHP programs (Wordfence Report, NVD Database).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It received a CVSS v3.1 base score of 8.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, indicating that it is network-accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (NVD Database).

The vulnerability allows unauthorized PHP Local File Inclusion, which could potentially lead to high confidentiality impact and low integrity impact. The absence of availability impact suggests that the vulnerability doesn't affect system stability (NVD Database).

The vulnerability has been patched in version 2.4.4 of the Businext theme. Users are strongly advised to update to this version or later to mitigate the risk (Wordfence Intel).