CVE-2025-59558

HighCVSS 8.1

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.54%

43th percentile - higher than 43% of all known CVEs

Summary

The Billey theme by ThemeMove has a PHP Local File Inclusion vulnerability due to improper filename control in include/require statements. Affects versions up to 2.1.6 (exclusive).

Risk Assessment

An attacker could exploit this to read sensitive files on the server or execute malicious code, potentially leading to data confidentiality and integrity breaches.

Recommendation

Update the Billey theme to version 2.1.6 or later. Restrict access to theme files and monitor server logs.

Other vulnerabilities in Billey

CVE-2026-57790High
The Billey WordPress plugin is vulnerable to Local File Inclusion (LFI) due to improper control of filename in include/require statements. The vulnerability affects versions up to and including 2.1.8.

Original NVD description (English source)

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Billey billey allows PHP Local File Inclusion.This issue affects Billey: from n/a through < 2.1.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS