The vulnerability CVE-2025-58942 affects the axiomthemes Dwell theme for WordPress, specifically versions up to 1.7.0. It is caused by improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This allows an attacker to include arbitrary local files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to an attacker including and executing arbitrary local files on the affected server. This can compromise the confidentiality, integrity, and availability of the system, potentially allowing full system compromise. The high CVSS score (8.1) reflects the severity of these impacts. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewall (WAF) rules to block suspicious include parameters, and limiting file permissions to reduce the impact of potential exploitation. Monitor vendor channels for patch announcements and apply updates promptly once released.