PT-2026-45741 · Fermentio · Fermentio

Published 2026-06-02 · Updated 2026-06-04 · CVE-2025-58897

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fermentio versions prior to 1.5.1

Description Improper Control of Filename for Include/Require Statement in PHP Program allows Local File Inclusion. This occurs when the application fails to properly validate the filename used in PHP include or require statements, potentially allowing an attacker to include and execute local files on the server.

Recommendations Update to a version newer than 1.5.0.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-58897

Affected Products

Fermentio

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-58897 · Security Note
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://patchstack.com/database/wordpress/theme/fermentio/vulnerability/wordpress-fermentio-theme-1-5-0-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://t.me/CVEtracker/55596 · Telegram Post