CVE

CVE-2025-2558

8.6

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server

Attack Vector

Network

Privileges Req.

None

User Interaction

None

the-wound

Updated Nov 10, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

WordPress The Wound Theme <= 0.0.1 - Local File Inclusion

The-wound WordPress theme through 0.0.1 contains a local file inclusion caused by insufficient validation of parameters used to generate paths passed to include functions, letting unauthenticated users perform LFI attacks and download arbitrary files from the server. References: https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/ https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-themes/the-wound/the-wound-001-unauthenticated-local-file-inclusion https://nvd.nist.gov/vuln/detail/cve-2025-2558

url

Scanner page →Run scanner

CVE history: the-wound

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →