CVE-2025-58879: 
WordPress vulnerability analysis and mitigation

CVE-2025-58879 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Festy WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Festy theme up to and including 1.13.0. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on July 24, 2025, and published by Patchstack on August 23, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper handling of filenames in PHP include/require statements within the Festy theme (CWE-98), allowing an attacker to manipulate file path inputs to include arbitrary local files from the server. The attack is network-based, requires no authentication or user interaction, but does require high attack complexity to exploit. Exploitation involves crafting requests that pass attacker-controlled file path values to vulnerable PHP include/require calls, enabling the inclusion and execution of local PHP files or disclosure of sensitive files such as configuration files containing database credentials (Patchstack).

Successful exploitation allows unauthenticated remote attackers to include and expose arbitrary local files on the server, potentially revealing sensitive configuration data such as database credentials, which could lead to complete database takeover. The vulnerability has high impacts on confidentiality, integrity, and availability. In a worst-case scenario, if an attacker can chain LFI with a file upload or log poisoning technique, arbitrary PHP code execution may be achievable, enabling further lateral movement within the hosting environment (Patchstack).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.053%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class and severity are commonly used in mass-exploit campaigns targeting WordPress sites at scale.

• Logs: Web server access logs showing unusual GET or POST requests to Festy theme PHP files with file path parameters containing traversal sequences (e.g., ../, ....//, or encoded variants %2e%2e%2f).
• Logs: PHP error logs indicating failed or successful file inclusion attempts referencing unexpected file paths or system files (e.g., /etc/passwd, wp-config.php).
• Network: Repeated requests from a single IP to theme-related endpoints with varying file path parameters, indicative of automated scanning or exploitation attempts.
• File System: Unexpected access or modification timestamps on sensitive files such as wp-config.php or system configuration files.
• Process: Unusual PHP processes spawning child processes or making outbound network connections from the web server.

The primary remediation is to update the AncoraThemes Festy WordPress theme to a version newer than 1.13.0 as soon as an official patch becomes available. If an immediate upgrade is not possible, consider disabling or removing the vulnerable theme and switching to an alternative until a patch can be safely applied. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additionally, monitor server logs for suspicious file inclusion attempts and restrict PHP file access permissions where feasible (Patchstack).

The vulnerability was discovered and responsibly disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, and coordinated through Patchstack's Vulnerability Disclosure Program. Patchstack has classified it as high priority and noted that LFI vulnerabilities of this severity are frequently leveraged in mass WordPress exploitation campaigns (Patchstack). No significant broader media coverage or notable social media discussion has been identified at this time.