CVE-2025-58923: 
WordPress vulnerability analysis and mitigation

CVE-2025-58923 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes Critique WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Critique theme up to and including version 1.17. The vulnerability was reported by security researcher "Bonds" on August 3, 2025, and published by Patchstack on September 2, 2025. It carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated attackers over the network (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Critique theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files on the server. Because no authentication is required, an unauthenticated remote attacker can craft a malicious HTTP request that passes a controlled filename to a vulnerable include/require call, causing the server to read and output the contents of arbitrary local files. The attack complexity is rated High, suggesting some precondition or non-trivial input manipulation is required to successfully exploit the flaw. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read sensitive files on the server, such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database compromise. In certain server configurations, an attacker may also be able to execute arbitrary PHP code by including malicious files (e.g., via log poisoning or uploaded file inclusion), resulting in full server compromise. The vulnerability affects confidentiality, integrity, and availability — all rated High in the CVSS scoring (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires no authentication and no user interaction, making it attractive for mass-exploit campaigns targeting WordPress sites at scale, as noted by Patchstack. The EPSS score is approximately 0.115%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Axiomthemes Critique theme version 1.17 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/critique).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion parameter that is improperly sanitized in an include/require statement.
3. Craft malicious request: Send a crafted HTTP GET or POST request to the vulnerable endpoint, supplying a path traversal payload (e.g., ../../../../wp-config.php) as the filename parameter value.
4. Extract sensitive data: If successful, the server returns the contents of the targeted file (e.g., wp-config.php), exposing database credentials, authentication keys, and salts.
5. Escalate (optional): In configurations where PHP session files or uploaded files are accessible, attempt log poisoning or include a previously uploaded PHP file to achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests to theme-related endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting Critique theme files; HTTP 200 responses to requests containing wp-config, /etc/passwd, or similar sensitive file paths.
• File System: Unexpected PHP files or web shells in the wp-content/themes/critique/ directory; recently modified theme files not associated with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI exploitation.

As of the time of publication, no official patch from Axiomthemes has been released for the Critique theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is available. Site administrators should upgrade the Critique theme to a version beyond 1.17 if a patched release becomes available, implement strict input validation for file inclusion mechanisms, use allowlists for permitted file paths, and deploy a Web Application Firewall (WAF) with LFI detection rules. Additionally, restricting file system permissions and monitoring for suspicious file access attempts are recommended interim measures (Patchstack).