CVE-2025-58707: WordPress Spin theme <= 1.8 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File Inclusion.
This issue affects Spin: from n/a through 1.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/spin (Axiomthemes)from your environment.Uninstall or disable the Spin theme (versions <= 1.8) from affected WordPress sites. If the theme is required, replace it with a different, secure theme or remove the vulnerable files until a fixed release is available.
- Operational
Inventory WordPress installations and identify any sites using the Spin theme at version 1.8 or earlier (Spin <= 1.8).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58707?
CVE-2025-58707 has a severity rating of high, with a score of 8.1.
How do I fix CVE-2025-58707?
To fix CVE-2025-58707, update the Axiomthemes Spin theme to version 1.9 or later.
What systems are affected by CVE-2025-58707?
CVE-2025-58707 affects Axiomthemes Spin theme versions from n/a through 1.8.
What type of vulnerability is CVE-2025-58707?
CVE-2025-58707 is a Local File Inclusion (LFI) vulnerability in PHP.
What are the potential risks of CVE-2025-58707?
CVE-2025-58707 can lead to unauthorized access to sensitive files and information on affected systems.