CVE-2025-58930: WordPress FitFlex theme <= 1.6 - Local File Inclusion vulnerability
Published Dec 18, 2025
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes FitFlex fitflex allows PHP Local File Inclusion.This issue affects FitFlex: from n/a through <= 1.6.
Affected Software
2 affected components
wordpress/fitflex<=1.6
axiomthemes Fitflex Wordpress<=1.6
Event History
Dec 18, 2025
CVE Published
via MITRE·07:21 AM
Data Sourced
via MITRE·07:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:16 AM
DescriptionSeverityWeaknessAffected Software
Feb 23, 58291
Event
via MITRE·12:46 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-58930?
CVE-2025-58930 is classified as a high severity vulnerability due to the risk of Remote File Inclusion.
2
How do I fix CVE-2025-58930?
To fix CVE-2025-58930, update the FitFlex theme to the latest version beyond 1.6, which addresses the local file inclusion issue.
3
Which versions of FitFlex are affected by CVE-2025-58930?
CVE-2025-58930 affects FitFlex versions from n/a up to and including version 1.6.
4
What kind of attacks can CVE-2025-58930 enable?
CVE-2025-58930 can enable attackers to execute arbitrary PHP code through remote file inclusion.
5
Is CVE-2025-58930 exploitable without authentication?
Yes, CVE-2025-58930 can be exploited without authentication, making it particularly dangerous.