CVE-2025-2558

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2558
The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/ Exploit Third Party Advisory
https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:the_wound_project:the_wound:*:*:*:*:*:wordpress:*:*
History

23 Jun 2025, 15:17

Type Values Removed Values Added
References () https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/ - () https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/ - Exploit, Third Party Advisory
CPE cpe:2.3:a:the_wound_project:the_wound:*:*:*:*:*:wordpress:*:*
CWE NVD-CWE-noinfo
First Time The Wound Project
The Wound Project the Wound

24 Apr 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.6
References () https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/ - () https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/ -
Summary
  • (es) El tema The-wound de WordPress hasta la versión 0.0.1 no valida algunos parámetros antes de usarlos para generar rutas pasadas para incluir funciones, lo que permite que usuarios no autenticados realicen ataques LFI y descarguen archivos arbitrarios del servidor.

24 Apr 2025, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-24 06:15

Updated : 2025-06-23 15:17

NVD link : CVE-2025-2558

Mitre link : CVE-2025-2558

CVE.ORG link : CVE-2025-2558

JSON object : View

Products Affected

the_wound_project

  • the_wound
CWE
NVD-CWE-noinfo