CVE-2025-58929: 
NixOS vulnerability analysis and mitigation

CVE-2025-58929 is a Local File Inclusion (LFI) vulnerability in the Pantry WordPress theme developed by Axiomthemes, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Pantry theme up to and including version 1.4, allowing unauthenticated remote attackers to include and execute arbitrary local files via PHP include/require statements. The vulnerability was reported on July 23, 2025, and published by Patchstack on August 22, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include or require statements within the Pantry theme (CWE-98). An attacker can manipulate a filename parameter passed to these PHP constructs to traverse the file system and include arbitrary local files, such as configuration files containing database credentials. The attack vector is network-based, requires no authentication or user interaction, but does involve high attack complexity. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation could allow an unauthenticated attacker to read sensitive files on the server, including WordPress configuration files (e.g., wp-config.php) that contain database credentials, potentially enabling complete database takeover. Depending on server configuration, the vulnerability may also facilitate arbitrary code execution if attacker-controlled content can be included. The confidentiality, integrity, and availability impacts are all rated High, reflecting the potential for credential theft, data manipulation, and service disruption (Patchstack).

No public proof-of-concept exploit has been observed, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites regardless of their traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Pantry theme (version ≤ 1.4) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's PHP include/require statement that accepts user-controlled input, typically via a GET or POST parameter in a theme template or AJAX handler.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../wp-config.php) in the vulnerable parameter to reference a sensitive local file.
4. Send malicious request: Submit the crafted HTTP request to the target WordPress site without authentication.
5. Extract sensitive data: Review the server response for the contents of the included file (e.g., database credentials from wp-config.php), which may enable further compromise such as database access or privilege escalation (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in parameter values; requests targeting theme AJAX handlers or template files with unexpected file path inputs.
• Logs: Web server access logs showing requests with encoded or plain path traversal strings (e.g., %2F..%2F, ../../../../) directed at Pantry theme endpoints; repeated 200 responses to such requests may indicate successful file inclusion.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files by the web server process.
• Process: Unusual PHP process behavior or error log entries referencing unexpected file paths being included or evaluated by the Pantry theme.

As of the publication date, no official patch from the Axiomthemes developer is available for the Pantry theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should disable or replace the Pantry theme if possible, or restrict access to the affected WordPress installation. Implementing a Web Application Firewall (WAF) with rules to detect and block path traversal and local file inclusion attempts is strongly recommended as an interim measure (Patchstack).

Patchstack, which discovered and disclosed the vulnerability (credited to researcher 'Bonds'), classifies it as high priority and warns that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media discussion has been identified beyond the Patchstack advisory (Patchstack).