CVE-2025-14430: 
NixOS vulnerability analysis and mitigation

CVE-2025-14430 is a Local File Inclusion (LFI) vulnerability in the ThemeMove Brook – Agency Business Creative WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all Brook theme versions through 2.9.0 (with some sources referencing ≤ 2.8.9 as the originally reported range). The vulnerability was reported by Tran Nguyen Bao Khanh of VCI – VNPT Cyber Immunity on August 16, 2025, and publicly disclosed by Patchstack on January 7–8, 2026. It carries a CVSS v3.1 base score of 8.1 (High) as assigned by Patchstack (Patchstack DB).

The root cause is improper validation of user-supplied input used to control filenames in PHP include/require statements (CWE-98), enabling PHP Local File Inclusion. An unauthenticated remote attacker can craft a malicious network request that manipulates a filename parameter accepted by the theme, causing the server to include and execute arbitrary local files. No authentication or user interaction is required, though the attack complexity is rated High (AC:H), suggesting some precondition such as specific server configuration or path traversal constraints must be met. No public proof-of-concept code has been identified at this time (Patchstack DB).

Successful exploitation allows an unauthenticated attacker to include and render arbitrary local files from the server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to full database compromise. The vulnerability carries high confidentiality, integrity, and availability impacts — attackers may read sensitive files, manipulate application behavior, or disrupt service. In a worst-case scenario, if combined with a file upload vulnerability or other weaknesses, LFI can escalate to remote code execution (Patchstack DB).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.0015 (0.15%), indicating a low but non-negligible probability of exploitation in the near term. No threat actor attribution is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites regardless of traffic size (Patchstack DB).

1. Reconnaissance: Identify WordPress sites using the ThemeMove Brook theme (versions ≤ 2.9.0) via passive scanning tools (e.g., WPScan, Shodan, or BuiltWith) or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Analyze the theme's PHP code or publicly available source to locate the file inclusion point where user-controlled input is passed to a PHP include/require statement without adequate sanitization.
3. Craft malicious request: Construct an unauthenticated HTTP request (GET or POST) targeting the vulnerable endpoint, injecting a path traversal payload (e.g., ../../../../wp-config.php) into the filename parameter.
4. Extract sensitive data: If successful, the server returns the contents of the included file (e.g., wp-config.php), exposing database credentials, authentication keys, and salts.
5. Escalate access: Use extracted database credentials to access the WordPress database directly, enabling account takeover, content manipulation, or further lateral movement within the hosting environment (Patchstack DB).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields; repeated requests from a single IP to theme-related PHP files.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal patterns targeting Brook theme endpoints; PHP error logs indicating failed file inclusion attempts or unexpected file reads.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or PHP session files; new or modified files in the theme directory.
• Process: PHP processes reading files outside the WordPress web root or accessing system configuration files not normally required during page rendering.

As of the disclosure date, no official patch from ThemeMove is available for the Brook theme. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is released. Site owners should consider deactivating the Brook theme and switching to an alternative until a patched version is published. Additional interim measures include implementing a Web Application Firewall (WAF) with rules to block path traversal and LFI patterns, restricting network access to the WordPress admin interface, and monitoring server logs for suspicious file inclusion attempts (Patchstack DB).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for January 5–11, 2026, highlighting it among notable disclosures of that period (Wordfence Blog). Patchstack, the assigning CNA, classified it as high priority and noted that LFI vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. No significant social media debate or vendor statements beyond the Patchstack advisory have been identified.