CVE-2025-53445: 
WordPress vulnerability analysis and mitigation

CVE-2025-53445 is a PHP Local File Inclusion (LFI) vulnerability in the Catwalk WordPress theme developed by Axiomthemes, affecting all versions up to and including 1.4. The flaw stems from improper control of filename for include/require statements (CWE-98), allowing unauthenticated remote attackers to manipulate file inclusion mechanisms. It was reported by researcher "Bonds" on August 3, 2025, and published by Patchstack on September 2, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Catwalk theme fails to properly validate or sanitize user-supplied input used in PHP include or require statements, enabling an attacker to manipulate the file path parameter to include arbitrary local files from the server's filesystem. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or bypass is needed (e.g., specific server configuration or path traversal constraints). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read sensitive files from the server's filesystem, such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database compromise. In certain server configurations, LFI can be escalated to remote code execution by including PHP-interpretable files (e.g., log files with injected PHP code or uploaded files). The vulnerability has high confidentiality, integrity, and availability impacts, potentially enabling full compromise of the affected WordPress installation (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.115%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites regardless of traffic size or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Catwalk theme (version ≤ 1.4) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's file inclusion mechanism — a parameter or request path that is passed unsanitized to a PHP include or require statement.
3. Craft LFI payload: Construct an HTTP request with a path traversal payload (e.g., ../../../../wp-config.php or /etc/passwd) targeting the vulnerable parameter.
4. Exfiltrate sensitive data: Submit the crafted request to the target server; if successful, the server returns the contents of the included file, exposing credentials or other sensitive data.
5. Escalate to RCE (if applicable): If the server logs PHP-injectable content (e.g., via User-Agent injection into access logs), include the log file to achieve remote code execution (Patchstack).

• Network: HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body targeting the Catwalk theme's endpoints; unusual GET/POST requests returning file contents (e.g., root: in response body indicating /etc/passwd inclusion).
• Logs: WordPress or web server access logs showing requests with encoded traversal strings or references to sensitive files (wp-config.php, /etc/passwd, /proc/self/environ); repeated 200 responses to unusual file path parameters.
• File System: Unexpected PHP webshells or scripts in the theme directory or upload directories; modified theme files with injected PHP code.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) if LFI is escalated to RCE via log poisoning.

As of the publication date, no official patch from Axiomthemes is available for the Catwalk theme. Site administrators are advised to disable or remove the Catwalk theme immediately if a patched version is not available. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Additional hardening measures include implementing strict input validation for file paths, using PHP's realpath() to sanitize inclusions, restricting web server file system permissions, and applying a Web Application Firewall (WAF) rule to block path traversal patterns (Patchstack).

Patchstack, which discovered and disclosed the vulnerability, has classified it as high priority and noted that LFI vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified at this time (Patchstack).