CVE-2025-58935 is a high severity (CVSS 8.1) PHP file inclusion flaw in Lunna, a WordPress theme from axiomthemes. Versions through 1.15 allow local file inclusion. The record gives no fixed version, so check the vendor and Patchstack, and delete the theme if it is not in use.
What's affected
Lunna versions through 1.15, per the record and the Patchstack entry.
The record does not name a fixed version. Check the Patchstack page and the theme vendor's changelog for the current patched release before you rely on an update.
Both active and inactive installs matter, since the theme files remain on disk.
How to check if you're exposed
Use WP-CLI on each WordPress site, or look at Appearance, Themes in the dashboard.
wp theme list --fields=name,status,version
wp theme get lunna --fields=name,version,status
Look at the version column for Lunna. The record covers versions through 1.15. Check inactive installs too, because a theme that is installed but not active can still have its files reachable on the server.
What to do now
- Run wp theme list on every site and find Lunna.
- Update to the vendor's latest release, and confirm in its changelog or on the Patchstack page that it addresses this issue.
- If the theme is not in use, delete it. If it is in use and no patched release exists, plan a switch to a maintained theme.
- Review web server logs for unusual requests to theme files, and keep a recent backup of the site and database.
- Delete inactive themes and plugins instead of leaving them installed.
- Run the site under an account that cannot read files outside its own directory.
Why it matters
The record describes improper control of the filename used by an include or require statement. A visitor supplied value can steer which local PHP file the theme loads. Depending on what is on the server, that can expose configuration or run code that was never meant to run for that request.
The record rates attack complexity as high, so a successful attempt depends on conditions beyond the attacker's control. The potential impact on confidentiality, integrity and availability is still all rated high.
The record classifies the weakness as CWE-98 (PHP File Inclusion).
File inclusion bugs let a request influence which file a PHP program loads and runs. On a WordPress site the web server user can usually read configuration files that hold database credentials, so a flaw in a single theme can expose the whole site, not just the theme.
Themes and plugins are third party code running with the same rights as WordPress itself. Treat them like any other dependency: keep an inventory, remove the ones you do not use, and update on a schedule.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a fixed version of Lunna?
The record lists versions through 1.15 as affected and gives no fixed version. Check the Patchstack page and the vendor changelog.
Does deleting an inactive Lunna install help?
Yes. An inactive theme still has files on disk, so removing it removes the exposure.
Sources
Last reviewed: 18 October 2026.
