CVE-2025-47474: 
WordPress vulnerability analysis and mitigation

CVE-2025-47474 is a PHP Local File Inclusion (LFI) vulnerability in the Ninetheme Anarkali WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Anarkali theme through and including version 1.0.9. The vulnerability was reported on August 29, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and publicly disclosed by Patchstack on January 8, 2026. It carries a CVSS v3.1 base score of 8.1 (High), assigned by Patchstack (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Anarkali theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server. Because no authentication or user interaction is required, a remote unauthenticated attacker can send a crafted network request to trigger the inclusion of sensitive server-side files. The attack complexity is rated High, suggesting some precondition or non-trivial condition must be met (e.g., specific server configuration or parameter guessing), but no privileges are needed. The vulnerability is mapped to CAPEC-193 (PHP Remote File Inclusion) and was discovered and reported through Patchstack's coordinated disclosure process (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and read arbitrary local files from the web server, potentially exposing sensitive data such as database credentials, configuration files (e.g., wp-config.php), and other server-side resources. Depending on server configuration, this could escalate to remote code execution if attacker-controlled content can be included. The vulnerability has HIGH impact on confidentiality, integrity, and availability, and could enable complete database or application compromise (Patchstack).

There is no public proof-of-concept exploit code available, and no evidence of active in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class (LFI, CVSS 8.1) are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Anarkali theme (version ≤ 1.0.9) via web crawlers, Shodan, WPScan, or similar tools that enumerate WordPress theme metadata.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion parameter that improperly accepts user-controlled input in an include/require statement.
3. Craft malicious request: Send a crafted HTTP GET or POST request to the vulnerable endpoint, supplying a path traversal payload (e.g., ../../../../wp-config.php) as the file inclusion parameter.
4. Extract sensitive data: If successful, the server returns the contents of the targeted local file (e.g., WordPress database credentials from wp-config.php) in the HTTP response.
5. Escalate access: Use extracted credentials or configuration data to gain further access to the database, admin panel, or other server resources, potentially leading to full site compromise (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body targeting the WordPress site running the Anarkali theme.
• Logs: WordPress or web server access logs (e.g., Apache/Nginx) showing repeated requests with file path manipulation patterns to theme-related endpoints; PHP error logs indicating failed file inclusion attempts referencing unexpected file paths.
• File System: Unexpected access or modification timestamps on sensitive files such as wp-config.php; presence of web shells or unfamiliar PHP files in the theme directory.
• Process: Unusual PHP processes spawning child processes (e.g., shell commands) if exploitation escalates to code execution.

As of the disclosure date, no official patch from the theme developer (Ninetheme) is available for the Anarkali theme. Patchstack has issued a virtual patching/mitigation rule for Patchstack users to block exploitation attempts until an official fix is released. Recommended actions include: immediately disabling or replacing the Anarkali theme if possible; implementing a Web Application Firewall (WAF) with rules to detect and block path traversal and file inclusion attempts; enforcing strict input validation and whitelisting for any file inclusion parameters; and regularly auditing all installed WordPress themes and plugins for known vulnerabilities (Patchstack).

Wordfence referenced this vulnerability in their weekly WordPress vulnerability intelligence report for the period of January 5–11, 2026, indicating it received attention within the WordPress security community. No significant vendor statements from Ninetheme or broader media coverage have been identified. Community reaction has been limited, consistent with the absence of a public PoC or active exploitation.