CVE-2025-58995: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability was discovered in the Leblix WordPress Theme versions 2.4 and below, identified as CVE-2025-58995. The vulnerability was reported on September 15, 2025, by Tran Nguyen Bao Khanh from VCI - VNPT Cyber Immunity and was publicly disclosed on September 17, 2025. The affected software is the Leblix - Laboratory & Research WordPress Theme developed by PBM Infotech Private Limited (Patchstack VDP).

The vulnerability is classified as a Local File Inclusion issue with a CVSS score of 8.1, indicating high severity. It falls under the OWASP Top 10 category A3: Injection. The vulnerability can be exploited without authentication, making it particularly dangerous (Patchstack VDP).

This vulnerability could allow malicious actors to include and display local files from the target website. Of particular concern is the potential access to files containing sensitive information such as database credentials, which could lead to a complete database compromise depending on the server configuration (Patchstack VDP).

The vulnerability has been patched in version 2.5 of the Leblix theme. Users are strongly advised to update to version 2.5 or later immediately. Additionally, Patchstack has issued a mitigation rule to block potential attacks until users can update to the fixed version (Patchstack VDP).