CVE-2025-58705: WordPress Crafti theme <= 1.12 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local File Inclusion.
This issue affects Crafti: from n/a through 1.12.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/craftifrom your environment.Uninstall the WordPress Crafti theme (versions <= 1.12) from affected sites. If the theme is required, replace it with a non-vulnerable theme or remove/disable the Crafti theme until a patched version is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58705?
The severity of CVE-2025-58705 is rated as high with a score of 8.1.
How do I fix CVE-2025-58705?
To fix CVE-2025-58705, update the Axiomthemes Crafti theme to a version above 1.12.
What is the impact of CVE-2025-58705?
CVE-2025-58705 allows attackers to perform Local File Inclusion, potentially leading to unauthorized access to sensitive files.
Which versions of Axiomthemes Crafti are affected by CVE-2025-58705?
CVE-2025-58705 affects Axiomthemes Crafti from n/a through version 1.12.
Where can I learn more about CVE-2025-58705?
You can learn more details about CVE-2025-58705 by reviewing security bulletins and announcements from trusted cybersecurity sources.