Security readout for executives and security teams
Plain-English summary
A flaw in the Billey WordPress theme (versions before 2.1.6) lets a remote attacker trick the site into loading unintended files from the server. That can expose sensitive configuration, credentials, or in some cases lead to code execution. Any public WordPress site running an unpatched Billey theme is at risk.
Executive priority
Treat as a high-priority patching item for any marketing or brand website built on the Billey theme. Public exploitation has not been confirmed, but the bug is unauthenticated and network-reachable, so unpatched sites should be remediated within the next standard maintenance window.
Technical view
Patchstack reports a PHP Local File Inclusion in ThemeMove's Billey theme up to and including 2.1.6, classified as CWE-98 (improper control of filename for include/require). CVSS 3.1 is 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), meaning network-reachable, unauthenticated, with high impact to confidentiality, integrity, and availability when exploitation succeeds.
Likely exposure
Exposure is limited to WordPress sites running ThemeMove's commercial Billey theme at version 2.1.6 or earlier. The vulnerable code path is reachable over the public web without authentication, so any internet-facing site using the theme should be considered exposed until patched.
Exploitation context
No KEV listing and no public exploit-in-the-wild reporting is cited in the provided sources. CVSS marks attack complexity as high, suggesting non-trivial conditions are required, but unauthenticated network reachability and a Patchstack advisory raise the likelihood that proof-of-concept activity will follow disclosure.
Researcher notes
Sources do not specify the vulnerable parameter or include path; Patchstack's advisory should be consulted for technical detail and the exact fixed version. CWE-98 framing plus the "from n/a through < 2.1.6" range suggests a parameter passed into a PHP include/require without sufficient validation. Treat affected-version metadata as approximate until confirmed against the vendor changelog.
Mitigation direction
- Upgrade the Billey theme to a version newer than 2.1.6 per ThemeMove's vendor guidance.
- If no fixed version is available, disable or remove the Billey theme on affected sites.
- Place the site behind a WAF and block requests containing path traversal or include parameters.
- Restrict PHP include/open_basedir and file system permissions to limit reachable files.
- Rotate WordPress secrets, database credentials, and API keys if compromise is suspected.
Validation and detection
- Inventory WordPress installations and identify any running the Billey theme at version <= 2.1.6.
- Check the Patchstack advisory for the fixed version and any indicators of compromise.
- Review web server and PHP error logs for unusual include parameters or unexpected file access.
- Confirm post-upgrade theme version in wp-content/themes/billey/style.css across environments.
- Re-scan with a vulnerability scanner that ingests Patchstack data to verify remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-98: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-59558 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.