CVE-2025-58705
PHP Local File Inclusion in Crafti
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| axiomthemes | crafti | From 1.0 (inc) to 1.12 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58705 is a Local File Inclusion (LFI) vulnerability found in the WordPress Crafti Theme versions 1.12 and below. It arises from improper control of filenames used in PHP include or require statements, allowing an attacker to include local files on the target website.
This vulnerability enables an unauthenticated attacker to exploit the theme to include sensitive local files, potentially exposing critical information such as database credentials.
The issue is classified under the OWASP Top 10 category A3: Injection and has a high severity CVSS score of 8.1.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to exposure of sensitive data including database credentials, which may result in a full database takeover depending on the server configuration.
Because the vulnerability can be exploited by unauthenticated attackers remotely, it poses a significant risk to websites using the affected theme, regardless of their size or popularity.
The vulnerability is expected to be targeted in mass-exploit campaigns, increasing the likelihood of attacks.
Currently, there is no official patch available, so immediate mitigation actions such as applying temporary rules or updating the theme are advised.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific detection method or commands provided in the available resources for identifying this Local File Inclusion vulnerability in the Crafti WordPress theme.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the temporary mitigation rule issued by Patchstack to block attacks exploiting this vulnerability until an official patch is released.
It is advised to update the Crafti theme to a non-vulnerable version once available or seek assistance from your hosting provider or a web developer to implement protective measures.
Using automated mitigation solutions from Patchstack can also help protect your website from exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an unauthenticated attacker to include local files on the target website, potentially exposing sensitive data such as database credentials. This exposure could lead to a full database takeover depending on the server configuration.
Such unauthorized access and potential data exposure can result in non-compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive personal and health information.
Therefore, exploitation of this vulnerability could lead to breaches of confidentiality, integrity, and availability of sensitive data, impacting compliance with these regulations.