PT-2025-52088 · Axiomthemes · Tacticool

Bonds · Published 2025-12-18 · Updated 2025-12-18 · CVE-2025-58937

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions axiomthemes Tacticool versions through 1.0.13

Description An issue exists in axiomthemes Tacticool that allows for PHP Local File Inclusion due to Improper Control of Filename for Include/Require Statement. This impacts the application's handling of file inclusion operations. The vulnerability allows an attacker to potentially include and execute arbitrary PHP files on the server.

Recommendations Update axiomthemes Tacticool to a version greater than 1.0.13.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-58937

Affected Products

Tacticool

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-58937 · Security Note
• https://osv.dev/vulnerability/CVE-2025-58937 · Vendor Advisory
• https://vdp.patchstack.com/database/Wordpress/Theme/tacticool/vulnerability/wordpress-tacticool-theme-1-0-13-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2001736676889047199 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/tacticool/vulnerability/wordpress-tacticool-theme-1-0-13-local-file-inclusion-vulnerability?_s_id=cve · Note