CVE-2025-53449: 
WordPress vulnerability analysis and mitigation

CVE-2025-53449 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes Convex WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement). It affects all versions of the Convex theme up to and including version 1.11, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by researcher "Bonds" on August 3, 2025, and published by Patchstack on September 2, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filenames used in PHP include/require statements (CWE-98), which allows user-supplied input to influence which local files are included by the theme. An unauthenticated attacker can craft a malicious HTTP request that manipulates the file path parameter, causing the server to include arbitrary local files and expose their contents. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or path traversal bypass). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary files from the server's filesystem, including sensitive configuration files such as wp-config.php, which contains database credentials. This can lead to complete database takeover, exposure of API keys and secrets, and potential for further code execution if combined with file upload vulnerabilities or other weaknesses. The confidentiality, integrity, and availability impacts are all rated High, indicating the potential for full application compromise (Patchstack).

No public proof-of-concept exploit code is currently known, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.115%, reflecting a low but non-negligible probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class (LFI with CVSS 8.1) are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Convex theme (version ≤ 1.11) via passive scanning tools (e.g., WPScan, Shodan, or Google dorks such as inurl:wp-content/themes/convex).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate parameters that influence file inclusion logic (e.g., template or file path parameters in theme functions).
3. Craft malicious request: Send an unauthenticated HTTP request to the target WordPress site with a manipulated file path parameter designed to traverse directories and include a sensitive local file (e.g., ../../../../wp-config.php).
4. Extract sensitive data: Review the HTTP response for the contents of the included file, which may expose database credentials, secret keys, or other configuration data from wp-config.php or other server files.
5. Escalate access: Use extracted credentials to access the WordPress database directly, log in to the WordPress admin panel, or pivot to other systems using reused credentials (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files (wp-config.php, /etc/passwd) in query parameters or request bodies.
• Logs: Web server access logs (Apache/Nginx) showing requests to Convex theme files with anomalous parameter values; repeated 200 responses to requests containing traversal patterns.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system files like /etc/passwd; new or modified files in the WordPress theme directory.
• Process: PHP error logs showing file inclusion warnings or failures for unexpected file paths, which may indicate probing or failed exploitation attempts.

As of the publication date, no official patch from the Axiomthemes developer is available for the Convex theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators should consider replacing or disabling the Convex theme if a patched version remains unavailable, implementing a web application firewall (WAF) rule to block path traversal patterns, and auditing file system permissions to limit PHP's ability to read sensitive files. Additionally, restricting PHP's open_basedir setting can limit the scope of file inclusion attacks (Patchstack).

Patchstack, which discovered and disclosed the vulnerability, has classified it as high priority and noted that LFI vulnerabilities of this severity are commonly leveraged in mass-exploit campaigns against WordPress sites. The vulnerability was noted in automated vulnerability tracking feeds including VulDB and CIRCL's vulnerability lookup service shortly after publication. No significant vendor statement from Axiomthemes or broader media coverage has been identified at this time (Patchstack).