CVE-2025-58933: 
NixOS vulnerability analysis and mitigation

CVE-2025-58933 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes Anubis WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement). It affects all versions of the Anubis theme up to and including version 1.25, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by researcher "Bonds" on July 23, 2025, and published by Patchstack on August 22, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability stems from improper control of filenames used in PHP include/require statements within the Anubis WordPress theme (CWE-98), allowing an attacker to manipulate file inclusion paths via network-accessible parameters. Because user-supplied input is not adequately sanitized or validated before being passed to file inclusion functions, an unauthenticated attacker can craft requests that cause the server to include arbitrary local files. The attack vector is network-based, requires no privileges or user interaction, and has high attack complexity. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the server, including sensitive configuration files such as wp-config.php (which contains database credentials), /etc/passwd, or other files accessible to the web server process. This can lead to full database compromise, credential theft, and potential further escalation depending on server configuration. The vulnerability has high impact on confidentiality, integrity, and availability, and could serve as a stepping stone for deeper system compromise (Patchstack).

There is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates this as high priority, noting that LFI vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites regardless of traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Anubis theme (version ≤ 1.25) via tools like WPScan, Shodan, or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Locate theme functionality that accepts user-controlled input used in file inclusion operations (e.g., template or file path parameters in HTTP requests).
3. Craft malicious request: Send a crafted HTTP GET or POST request with a manipulated file path parameter using directory traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Retrieve sensitive data: The server processes the inclusion and returns the contents of the targeted file (e.g., database credentials from wp-config.php) in the HTTP response.
5. Escalate access: Use harvested credentials or configuration data to gain further access to the database, admin panel, or underlying server (Patchstack).

• Network: Unusual HTTP requests containing directory traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body targeting the Anubis theme endpoints; unexpected outbound connections from the web server.
• Logs: Web server access logs showing requests with path traversal patterns (e.g., ../../../../etc/passwd or ../../../../wp-config.php) to theme-related URLs; repeated 200 responses to such requests.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other configuration files not normally accessed via web requests.
• Process: PHP error logs showing file inclusion warnings or errors referencing unexpected file paths outside the theme directory.

As of the publication date, no official patch from the Axiomthemes developer has been confirmed; the Patchstack advisory notes "No official patch available" for versions ≤ 1.25. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: updating the Anubis theme to any version above 1.25 if/when released, deploying a Web Application Firewall (WAF) with rules to block path traversal and file inclusion attempts, implementing strict server-side input validation, and reviewing hosting environment file permissions to limit what the web server process can read (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher "Bonds," has classified it as high priority and issued a virtual mitigation rule for its platform users. No significant broader media coverage, vendor statements from Axiomthemes, or notable social media commentary has been identified at this time (Patchstack).