CVE-2025-58937: 
WordPress vulnerability analysis and mitigation

CVE-2025-58937 is a Local File Inclusion (LFI) vulnerability in the Tacticool WordPress theme developed by axiomthemes, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Tacticool theme up to and including version 1.0.13. The vulnerability was reported by security researcher "Bonds" on July 23, 2025, and published by Patchstack on August 22, 2025. It carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Tacticool WordPress theme (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server. The attack vector is network-based, requires no authentication or user interaction, but has high attack complexity. By supplying a crafted file path parameter in an HTTP request, an attacker can cause the PHP interpreter to include and execute or expose the contents of sensitive local files on the server (Patchstack). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This can lead to complete database takeover, exposure of authentication secrets, and potentially further compromise of the WordPress installation and underlying server. The confidentiality, integrity, and availability impacts are all rated High per the CVSS scoring (Patchstack).

No official patch is currently available for the Tacticool theme, and Patchstack has assessed this vulnerability as highly likely to be exploited in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity. The vulnerability requires no authentication or user interaction, lowering the barrier for exploitation significantly. The EPSS score is approximately 0.053% (0.000530), indicating a currently low but non-negligible probability of exploitation in the near term. No CISA KEV catalog listing or confirmed in-the-wild exploitation has been reported at this time (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Tacticool theme (version <= 1.0.13) via tools like WPScan, Shodan, or by inspecting page source for theme references (e.g., /wp-content/themes/tacticool/).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion parameter that accepts user-controlled input without proper sanitization.
3. Craft malicious request: Construct an HTTP GET or POST request targeting the vulnerable endpoint with a manipulated file path parameter (e.g., path traversal sequences like ../../../../wp-config.php) to reference sensitive local files.
4. Retrieve sensitive files: Send the crafted request to the target site; if successful, the server will include and output the contents of the targeted file (e.g., database credentials from wp-config.php).
5. Escalate access: Use extracted credentials or secrets to access the WordPress database, escalate privileges, or pivot to further compromise the hosting environment (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests to Tacticool theme PHP files with suspicious file path parameters; HTTP 200 responses to requests containing traversal patterns targeting sensitive files like wp-config.php or /etc/passwd.
• File System: No direct file system artifacts expected from read-only LFI, but watch for subsequent unauthorized file creation or modification if LFI is chained with other vulnerabilities.
• Process: Unexpected database connection attempts from the web server process using credentials that may have been extracted from wp-config.php (Patchstack).

No official patch from the theme developer (axiomthemes) is currently available for the Tacticool theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators are advised to either remove or replace the Tacticool theme immediately, or deploy a web application firewall (WAF) rule to block path traversal patterns in requests. Contacting the hosting provider for additional server-level protections is also recommended (Patchstack).

Patchstack, which discovered and disclosed the vulnerability, has classified it as high priority and warned that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale. No notable vendor statements from axiomthemes or significant social media commentary have been identified at this time (Patchstack).