Local File Inclusion Vulnerability in Immonex Kickstart by Immonex
CVE-2025-58637

7.5HIGH

Key Information:

Vendor

WordPress
Status
Immonex Kickstart
Vendor
CVE Published:
3 September 2025

What is CVE-2025-58637?

The vulnerability identified in Immonex Kickstart is a result of improper control over the filename attribute in PHP include/require statements, allowing attackers to exploit local file inclusion (LFI) vulnerabilities. This weakness can lead to unauthorized access to sensitive files on the server, potentially compromising the web application's integrity and the confidentiality of its data.

Affected Version(s)

immonex Kickstart <= 1.11.6

References

https://patchstack.com/database/wordpress/plugin/immonex-...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Thaleikis (Patchstack Alliance)
.
CVE-2025-58637 : Local File Inclusion Vulnerability in Immonex Kickstart by Immonex