CVE-2025-58707

Vulnerability

An Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, commonly known as PHP Remote File Inclusion, exists in Axiomthemes Spin theme. This vulnerability allows for PHP Local File Inclusion. The issue affects Spin versions from n/a through 1.8 [1].

Exploitation

An attacker can exploit this vulnerability by including local files from the target website. The specific conditions or required user interaction for exploitation are not detailed in the available references, but it is expected to be exploited in mass-exploit campaigns [1].

Impact

Successful exploitation allows a malicious actor to include local files of the target website and display their output. This could lead to the disclosure of sensitive files, such as those containing database credentials, potentially enabling a complete database takeover depending on the server's configuration [1].

Mitigation

The recommended mitigation is to update the affected plugin to a version later than 1.8. If an update is not immediately possible, users should seek assistance from their hosting provider or web developer. The exact fixed version and release date are not specified, nor is the EOL status or KEV listing [1].