CVE-2025-58885: WordPress Pathfinder theme <= 1.16 - Local File Inclusion vulnerability
Published Dec 18, 2025
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <= 1.16.
Affected Software
2 affected components
wordpress/pathfinder<=1.16
AncoraThemes Pathfinder Wordpress<=1.16
Event History
Dec 18, 2025
CVE Published
via MITRE·07:21 AM
Data Sourced
via MITRE·07:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeaknessAffected Software
Jan 12, 58291
Event
via MITRE·07:39 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-58885?
CVE-2025-58885 has a critical severity rating due to its potential for local file inclusion attacks.
2
How do I fix CVE-2025-58885?
To fix CVE-2025-58885, update the Pathfinder theme to version 1.17 or higher.
3
What are the potential impacts of CVE-2025-58885?
The potential impacts of CVE-2025-58885 include unauthorized access to sensitive files on the server.
4
Is CVE-2025-58885 still active in later versions?
No, CVE-2025-58885 is not present in versions of the Pathfinder theme later than 1.16.
5
Who is affected by CVE-2025-58885?
Users running the Pathfinder theme version 1.16 or earlier are affected by CVE-2025-58885.