CVE-2025-58946: WordPress Vocal theme <= 1.12 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Vocal vocal allows PHP Local File Inclusion.This issue affects Vocal: from n/a through <= 1.12.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-58946?
CVE-2025-58946 has a critical severity rating due to its potential for local file inclusion vulnerabilities in affected PHP applications.
How do I fix CVE-2025-58946?
To fix CVE-2025-58946, update AxiomThemes Vocal to version 1.13 or later to eliminate the local file inclusion vulnerability.
What software is affected by CVE-2025-58946?
CVE-2025-58946 affects AxiomThemes Vocal and WordPress Vocal versions up to and including 1.12.
What type of vulnerability is CVE-2025-58946?
CVE-2025-58946 is classified as a Remote File Inclusion and Local File Inclusion vulnerability in PHP applications.
Is there a workaround for CVE-2025-58946?
A temporary workaround for CVE-2025-58946 includes restricting user input regarding file paths until the software can be updated.