CVE-2025-54701: 
WordPress vulnerability analysis and mitigation

CVE-2025-54701 is a Local File Inclusion (LFI) vulnerability in the ThemeMove Unicamp WordPress theme that allows unauthenticated remote attackers to include and execute arbitrary server-side files. It affects all versions of the Unicamp theme up to and including 2.6.3, with version 2.6.4 containing the fix. The vulnerability was reported on July 15, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and publicly disclosed on August 14, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 8.1 (High) per Patchstack (Patchstack, Red Hat CVE).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is passed unsanitized into PHP include or require statements within the Unicamp theme. This allows an attacker to manipulate the filename parameter to reference arbitrary files on the server's filesystem. Exploitation requires no authentication, no user interaction, and can be performed remotely over the network with low complexity, making it trivially exploitable against any unpatched installation (Patchstack, Red Hat CVE).

Successful exploitation allows an unauthenticated attacker to read sensitive server files — including WordPress configuration files such as wp-config.php containing database credentials — potentially enabling complete database takeover. Attackers may also execute arbitrary PHP code on the server, modify website content, and fully compromise the web application. The combination of high confidentiality, integrity, and availability impact with no privilege requirement makes this a severe threat to any site running the vulnerable theme (Patchstack).

No public proof-of-concept exploit code has been confirmed at this time, and there is no verified evidence of active in-the-wild exploitation. However, Patchstack has flagged this vulnerability as "Known to be exploited (KEV)" in their database and notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. The EPSS score is approximately 0.0015 (0.15%), indicating currently low but non-negligible exploitation probability. No specific threat actor attribution has been reported (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThemeMove Unicamp theme version 2.6.3 or earlier using tools like WPScan, Shodan, or by inspecting HTTP response headers and theme file paths (e.g., /wp-content/themes/unicamp/).
2. Identify vulnerable parameter: Locate the theme's PHP file(s) that accept user-controlled input passed to an include or require statement, typically via a GET or POST parameter controlling a template or file path.
3. Craft malicious request: Send an HTTP request with a manipulated filename parameter pointing to a sensitive server file, such as ../../../../wp-config.php or other files accessible to the web server process.
4. Extract sensitive data: The server includes and outputs the targeted file's contents, exposing database credentials, secret keys, or other configuration data from wp-config.php.
5. Escalate access: Use extracted database credentials to access the WordPress database directly, create admin accounts, or chain with other vulnerabilities to achieve remote code execution and full site compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to Unicamp theme files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameters; requests to theme endpoints with unexpected file path values.
• Logs: Web server access logs showing requests to /wp-content/themes/unicamp/ endpoints with traversal patterns or references to sensitive files like wp-config.php; PHP error logs indicating failed file inclusion attempts.
• File System: Unexpected new PHP files or web shells dropped in the theme directory or WordPress uploads folder; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server (e.g., curl, wget, bash) indicating potential code execution following successful LFI exploitation (Patchstack).

The primary remediation is to upgrade the ThemeMove Unicamp WordPress theme to version 2.6.4 or later, which contains the patch for this vulnerability. For sites where immediate patching is not feasible, implement network-level controls to restrict external access to vulnerable theme files, disable non-essential theme functionality, and monitor web server logs for suspicious file inclusion attempts. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the theme is updated (Patchstack).

The vulnerability was discovered and reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and disclosed through Patchstack on August 14, 2025. Patchstack classified it as high priority and flagged it as likely to be used in mass-exploit campaigns. A Bluesky post referencing the CVE was noted in threat intelligence feeds shortly after disclosure, indicating some community awareness, though no major media coverage or notable researcher commentary beyond the initial Patchstack advisory has been identified (Patchstack).