CVE-2025-58897

Vulnerability

An Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, exists in Axiomthemes Fermentio. This issue allows for PHP Local File Inclusion and affects versions up to and including 1.5.0 [1].

Exploitation

An attacker can exploit this vulnerability by including local files from the target website. The exact steps required for exploitation are not detailed in the available references, but it is expected to be used in mass-exploit campaigns [1].

Impact

Successful exploitation allows a malicious actor to include local files and display their output. This could lead to the disclosure of sensitive information, such as database credentials, potentially resulting in a complete database takeover depending on the server configuration [1].

Mitigation

It is recommended to update the affected plugin to a version later than 1.5.0. If an update is not immediately possible, users should seek assistance from their hosting provider or web developer [1]. A specific fixed version and release date are not yet disclosed in the available references.