CVE-2025-58900: 
WordPress vulnerability analysis and mitigation

CVE-2025-58900 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes UniTravel WordPress theme, affecting all versions up to and including 1.4.2. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98). It was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on July 24, 2025, and published by Patchstack on August 23, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion attacks. An unauthenticated attacker can manipulate file path parameters accepted by the UniTravel theme to force the PHP interpreter to include arbitrary local files from the server's filesystem. Exploitation requires no user interaction and no authentication, though the high attack complexity rating suggests some preconditions — such as specific server configurations or knowledge of file paths — may be necessary. No public proof-of-concept code has been disclosed at this time (Patchstack).

Successful exploitation allows an attacker to read sensitive files from the server, including configuration files containing database credentials (e.g., WordPress wp-config.php), which could lead to complete database takeover. Beyond credential theft, LFI vulnerabilities can be chained with log poisoning or other techniques to achieve arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected WordPress site. The CVSS score reflects high impact across all three dimensions (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.115%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the UniTravel theme (version ≤ 1.4.2) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Locate theme functionality that accepts a filename or path parameter passed to a PHP include() or require() call — typically exposed via GET/POST parameters in theme template files.
3. Craft LFI payload: Construct a request with a manipulated file path parameter using directory traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Send malicious request: Submit the crafted HTTP request to the target WordPress site without authentication.
5. Extract sensitive data: Review the server response for included file contents, such as database credentials from wp-config.php, which can then be used for further compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing directory traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameter values; requests targeting sensitive file paths such as wp-config.php or /etc/passwd.
• Logs: Web server access logs showing requests with path traversal patterns to theme-related URLs; repeated 200 OK responses to requests with suspicious file path parameters from a single IP.
• File System: Unexpected new files (e.g., web shells) in the WordPress theme directory or uploads folder if LFI is chained with file upload for code execution.
• Process: Unusual PHP processes spawning child processes or making outbound network connections from the web server.

As of the publication date, no official patch from AncoraThemes is available for the UniTravel theme. Immediate recommended actions include disabling or removing the UniTravel theme if it is not essential, or replacing it with a patched version once one becomes available. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts in the interim. Additionally, deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns, and conducting a security audit of the WordPress installation, are strongly advised (Patchstack).