CVE-2025-58206 is a high severity (CVSS 8.1) PHP file inclusion flaw in MaxCoach, a WordPress theme from ThemeMove. Versions through 3.2.5 allow local file inclusion. The record gives no fixed version, so check the vendor changelog and Patchstack, and remove the theme if you do not use it.
What's affected
MaxCoach versions through 3.2.5, per the record and the Patchstack entry.
The record does not name a fixed version. Check the Patchstack page and the theme vendor's changelog for the current patched release before you rely on an update.
Both active and inactive installs matter, since the theme files remain on disk.
How to check if you're exposed
Use WP-CLI on each WordPress site, or look at Appearance, Themes in the dashboard.
wp theme list --fields=name,status,version
wp theme get maxcoach --fields=name,version,status
Look at the version column for MaxCoach. The record covers versions through 3.2.5. Check inactive installs too, because a theme that is installed but not active can still have its files reachable on the server.
What to do now
- Run wp theme list on every site and find MaxCoach.
- Update to the vendor's latest release, and confirm in its changelog or on the Patchstack page that it addresses this issue.
- If the theme is not in use, delete it. If it is in use and no patched release exists, plan a switch to a maintained theme.
- Review web server logs for unusual requests to theme files, and keep a recent backup of the site and database.
- Delete inactive themes and plugins instead of leaving them installed.
- Run the site under an account that cannot read files outside its own directory.
Why it matters
The record classes this as improper control of the filename in an include or require statement. In practice a value that a visitor can influence reaches the code that decides which PHP file to load. Local file inclusion lets the application load a file from its own server that it was never meant to run or reveal.
The CVSS complexity is rated high, which means conditions beyond the attacker's control have to line up. That lowers the odds, but themes run with the same rights as the rest of WordPress, so the possible impact stays large.
The record classifies the weakness as CWE-98 (PHP File Inclusion).
File inclusion bugs let a request influence which file a PHP program loads and runs. On a WordPress site the web server user can usually read configuration files that hold database credentials, so a flaw in a single theme can expose the whole site, not just the theme.
Themes and plugins are third party code running with the same rights as WordPress itself. Treat them like any other dependency: keep an inventory, remove the ones you do not use, and update on a schedule.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a fixed version of MaxCoach?
The record lists versions through 3.2.5 as affected and gives no fixed version. Check the Patchstack page and the vendor changelog.
Does deleting an inactive MaxCoach install help?
Yes. An inactive theme still has files on disk, so removing it removes the exposure.
Sources
Last reviewed: 18 October 2026.
