CVE-2025-58899: 
NixOS vulnerability analysis and mitigation

CVE-2025-58899 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Frame WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Frame theme up to and including 2.4.0, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on July 24, 2025, and published by Patchstack on August 23, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the AncoraThemes Frame theme (CWE-98). An unauthenticated attacker can manipulate user-supplied input that is passed directly into file inclusion functions, allowing them to traverse the file system and include arbitrary local files. The attack is delivered over the network with high attack complexity and requires no user interaction or privileges. No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an attacker to read sensitive files on the server, such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. Depending on server configuration, an attacker may also be able to execute arbitrary PHP code by including malicious files, compromising the confidentiality, integrity, and availability of the affected WordPress site. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of websites regardless of size or popularity (Patchstack).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.115%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability requires no authentication and no user interaction, lowering the barrier for exploitation once a PoC becomes available. It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has classified it as high priority and warns it is expected to be exploited in mass-exploit campaigns (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the AncoraThemes Frame theme version ≤ 2.4.0 using tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's file inclusion mechanism — specifically, a parameter passed to a PHP include or require statement without proper sanitization or whitelisting.
3. Craft malicious request: Send a crafted HTTP request (e.g., GET or POST) to the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Retrieve sensitive data: The server processes the inclusion and returns the contents of the targeted file (e.g., database credentials from wp-config.php) in the HTTP response.
5. Escalate access: Use retrieved credentials to access the WordPress database directly, enabling full site takeover, data exfiltration, or further lateral movement within the hosting environment (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests with encoded traversal patterns targeting theme-related PHP files; HTTP 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files by the web server process.
• Process: PHP error logs showing file inclusion attempts for paths outside the WordPress installation directory.

As of the publication date, no official patch from AncoraThemes is available for the Frame theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should update the theme to a version beyond 2.4.0 if and when one becomes available, or consider replacing the theme. In the interim, implement strict input validation for file inclusion paths, use PHP configuration settings to restrict file system access (open_basedir), and apply the principle of least privilege to the web server process (Patchstack).

Patchstack, which coordinated the disclosure, has flagged this vulnerability as high priority and warns it is the type commonly leveraged in mass-exploit campaigns against WordPress sites. The vulnerability was discovered and reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity. No significant broader media coverage or notable social media discussion has been identified at this time (Patchstack).