CVE-2025-58901: 
WordPress vulnerability analysis and mitigation

CVE-2025-58901 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Takeout WordPress theme, affecting all versions up to and including 1.3.0. The flaw stems from improper control of filenames used in PHP include/require statements (CWE-98), allowing unauthenticated network attackers to include arbitrary local files. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on July 24, 2025, and published by Patchstack on August 23, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Takeout WordPress theme fails to properly sanitize or validate user-supplied input before using it in PHP include or require statements, enabling an attacker to manipulate the filename parameter to reference arbitrary files on the server's filesystem. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or path traversal conditions). No public proof-of-concept code has been identified (Patchstack).

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, including sensitive files such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. Beyond credential theft, LFI vulnerabilities can be chained with log poisoning or other techniques to achieve remote code execution, potentially compromising the full integrity, confidentiality, and availability of the affected WordPress site. The CVSS score reflects high impact across all three security dimensions (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.115%, indicating a low near-term probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites regardless of traffic size or popularity, suggesting elevated risk if a PoC becomes public (Patchstack).

1. Reconnaissance: Identify WordPress sites using the AncoraThemes Takeout theme version 1.3.0 or earlier using tools like WPScan, Shodan, or Google dorks targeting theme-specific files.
2. Identify vulnerable parameter: Locate the theme's file inclusion mechanism — typically a URL parameter or POST field that controls which file is included by the PHP include/require statement.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../wp-config.php or ../../../../etc/passwd) in the vulnerable parameter to reference sensitive server files.
4. Send the request: Submit the crafted HTTP request to the target WordPress site without any authentication credentials.
5. Extract sensitive data: Review the server's response for the contents of the included file, such as database credentials from wp-config.php, which can then be used for further compromise such as database access or privilege escalation (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded path traversal strings targeting theme-related PHP files; PHP error logs indicating failed file inclusion attempts for unexpected file paths.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or server configuration files that do not correspond to legitimate administrative activity.
• Process: PHP processes reading files outside the WordPress web root directory, particularly system files or credential stores.

As of the publication date, no official patch from AncoraThemes has been released for the Takeout theme. Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts until an official fix is available. Site owners should immediately update the Takeout theme if a patched version beyond 1.3.0 becomes available, or consider replacing the theme. In the interim, implement strict input validation for file inclusion parameters at the WAF or application level, use allow-lists for permitted file paths, and ensure allow_url_include is disabled in php.ini. Monitoring web server logs for path traversal patterns is also recommended (Patchstack).

The vulnerability was discovered and disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and coordinated through Patchstack's Vulnerability Disclosure Program. Patchstack classified it as high priority and noted that LFI vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media discussion has been identified beyond the Patchstack advisory (Patchstack).