CVE-2025-58898: 
WordPress vulnerability analysis and mitigation

CVE-2025-58898 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes HealthHub WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement). It affects all HealthHub theme versions through 1.3.0 and can be exploited by unauthenticated remote attackers. The vulnerability was reported on July 24, 2025, by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) and published by Patchstack on August 23, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the HealthHub theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server. This is a network-based attack requiring no authentication and no user interaction, though it has high attack complexity. The vulnerability is classified under OWASP Top 10 A3: Injection and enables an attacker to read the contents of sensitive server-side files by passing crafted path values to vulnerable theme code (Patchstack).

Successful exploitation allows unauthenticated attackers to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as WordPress wp-config.php (which contains database credentials). This can lead to full database compromise, unauthorized disclosure of confidential information, integrity violations, and potential service disruption. The CVSS score reflects high impact across confidentiality, integrity, and availability (Patchstack).

As of the time of publication, there is no known public proof-of-concept exploit and no confirmed in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. However, Patchstack rates this as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale. No threat actor attribution is available, and the vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify WordPress sites using the HealthHub theme (version ≤ 1.3.0) via web crawlers, Shodan, or WordPress-specific fingerprinting tools.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion point where user-supplied input is passed to an include or require statement without adequate sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request with a manipulated filename parameter (e.g., path traversal sequences such as ../../../../wp-config.php) targeting the vulnerable endpoint.
4. Retrieve sensitive files: The server processes the crafted path and returns the contents of the targeted local file (e.g., database credentials from wp-config.php) in the HTTP response.
5. Escalate access: Use exposed credentials or configuration data to gain further access to the database or WordPress admin panel, enabling full site takeover (Patchstack).

• Network: Unusual HTTP GET or POST requests to HealthHub theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or form fields.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting theme PHP files; repeated 200 responses to requests with suspicious filename parameters.
• File System: No direct file system artifacts expected from read-only LFI, but monitor for unexpected access to wp-config.php, /etc/passwd, or other sensitive files in server access logs.
• Application Logs: WordPress or PHP error logs showing unexpected file inclusion attempts or warnings about invalid file paths.

As of the Patchstack publication date (August 23, 2025), no official patch from AncoraThemes is available for the HealthHub theme. Site owners should update to a version beyond 1.3.0 if and when a patched release becomes available. In the interim, Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts. Administrators unable to update should consider temporarily deactivating the theme, restricting access to the WordPress site, or consulting their hosting provider for additional server-level protections (Patchstack).

The vulnerability was discovered and disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and published through Patchstack's vulnerability disclosure program. Patchstack has flagged it as high priority, warning that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media discussion has been identified at this time (Patchstack).