CVE-2025-54709: 
WordPress vulnerability analysis and mitigation

CVE-2025-54709 is a Local File Inclusion (LFI) vulnerability in the WordPress Sala theme by uxper, classified under PHP Remote File Inclusion (CWE-98). It affects all versions of the Sala theme up to and including 1.1.6, and was discovered by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on July 5, 2025, with public disclosure on August 20, 2025, and CVE publication on September 9, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication or user interaction (Patchstack, Red Hat CVE).

The vulnerability is rooted in improper control of filename parameters used in PHP include/require statements (CWE-98), allowing an attacker to manipulate file inclusion paths within the Sala WordPress theme. By supplying a crafted input to a vulnerable parameter, an unauthenticated remote attacker can cause the application to include arbitrary local files from the server's filesystem. Exploitation requires high attack complexity (AC:H per CVSS), suggesting some precondition or environmental factor must be met, but no privileges or user interaction are required. The vulnerability was assigned PSID 734caf3a58cf by Patchstack, which has issued a virtual patch/mitigation rule (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as database credentials (e.g., wp-config.php), configuration files, and other server-side resources. Depending on server configuration, this could lead to full database compromise, credential theft, and further lateral movement within the hosting environment. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, indicating the potential for complete application compromise (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.0015 (0.15%), indicating a currently low probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Sala theme (version ≤ 1.1.6) via passive scanning tools (e.g., WPScan, Shodan, or Google dorks targeting theme-specific files).
2. Identify vulnerable parameter: Locate the theme's file inclusion mechanism — a parameter that accepts a filename or path and passes it unsanitized to a PHP include/require statement.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Extract sensitive data: Review the server's response for the contents of the included file, which may contain database credentials, API keys, or other sensitive configuration data.
5. Escalate access: Use extracted credentials (e.g., database username/password from wp-config.php) to gain further access to the database or other systems (Patchstack).

• Network: Unusual HTTP GET or POST requests to Sala theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or request bodies.
• Logs: WordPress or web server access logs showing requests with encoded directory traversal patterns targeting theme PHP files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other configuration files by the web server process.
• Process: Web server process (e.g., Apache, Nginx, PHP-FPM) reading files outside the WordPress document root or theme directory.

The primary remediation is to update the Sala WordPress theme to version 1.1.7 or later, which contains the fix for this vulnerability (Patchstack). As an interim measure, Patchstack has issued a virtual patching/WAF rule to block exploitation attempts for subscribers. Additional hardening steps include disabling PHP remote file inclusion (allow_url_include = Off in php.ini), implementing strict input validation and allowlists for any file inclusion paths, and applying the principle of least privilege to the web server process.

Patchstack, which coordinated the disclosure, classified the vulnerability as high priority and noted that LFI vulnerabilities of this type are commonly leveraged in mass WordPress exploitation campaigns. The vulnerability was credited to Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, who reported it on July 5, 2025 (Patchstack). No broader media coverage or notable social media discussion has been identified at this time.