CVE-2025-2558

{"id": "CVE-2025-2558", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2025-04-24T06:15:45.800", "references": [{"url": "https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server"}, {"lang": "es", "value": "El tema The-wound de WordPress hasta la versi\u00f3n 0.0.1 no valida algunos par\u00e1metros antes de usarlos para generar rutas pasadas para incluir funciones, lo que permite que usuarios no autenticados realicen ataques LFI y descarguen archivos arbitrarios del servidor."}], "lastModified": "2025-06-23T15:17:34.443", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:the_wound_project:the_wound:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "1B939288-6C53-42EE-B321-4981EC090C42", "versionEndIncluding": "0.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}