# CVE-2025-2558: The-Wound - LFI

> Live exploitation tracking for CVE-2025-2558 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-2558

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.6
- **Public exploit available:** Yes
- **Affected products:** WordPress The-Wound
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** wordpress, cms

## Description

The-Wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server

## CrowdSec analysis

[CVE-2025-2558](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-2558) is a high-severity vulnerability in the The-Wound WordPress theme up to version 0.0.1, where improper validation of parameters allows unauthenticated attackers to exploit local file inclusion (LFI). This flaw can be leveraged to download arbitrary files from the server, potentially exposing sensitive information and configuration data to remote attackers.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of May 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-2558 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the endpoint `/wp-content/themes/the-wound/force_download.php` by manipulating the `file` parameter to include sensitive files such as `../../../wp-config.php` or `/etc/passwd`, enabling local file inclusion and potential information disclosure.

## Timeline

- 2025-04-24: CVE Published. CVE-2025-2558 is published to NVD.
- 2026-05-22: Rule Released. CrowdSec releases a rule to detect CVE-2025-2558 exploitation attempts against the CrowdSec Network.
- 2026-08-18: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-2558 for the first time.

## References

- https://wpscan.com/vulnerability/6a8e1c89-a01d-4347-91fc-ba454784b153/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2558.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-2558) follows observed exploitation activity for CVE-2025-2558. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.