CVE-2025-58942: 
WordPress vulnerability analysis and mitigation

CVE-2025-58942 is a Local File Inclusion (LFI) vulnerability in the axiomthemes Dwell WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Dwell theme up to and including 1.7.0, and can be exploited by unauthenticated remote attackers. The vulnerability was reported on July 20, 2025, and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Dwell WordPress theme (CWE-98), which allows user-supplied input to influence which local files are included and rendered. An unauthenticated attacker can craft a network request that manipulates the filename parameter to include arbitrary local files from the server's filesystem, causing their contents to be disclosed or executed. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or non-trivial exploitation step is involved. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary files from the server, including sensitive configuration files such as WordPress wp-config.php (which contains database credentials), potentially enabling complete database takeover. The vulnerability carries high confidentiality, integrity, and availability impacts, meaning attackers could not only exfiltrate sensitive data but potentially leverage exposed credentials for further lateral movement or full site compromise. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

As of the time of publication, no public proof-of-concept exploit exists and there is no confirmed evidence of in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.053%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Patchstack classifies this as high priority and warns it is the type of vulnerability used in mass-exploit campaigns.

1. Reconnaissance: Identify WordPress sites using the Dwell theme (version ≤ 1.7.0) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source (/wp-content/themes/dwell/style.css).
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion mechanism — typically a template or page parameter that accepts a filename value without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Retrieve sensitive data: If successful, the server returns the contents of the targeted file (e.g., wp-config.php with database credentials, etc/passwd, or other sensitive configuration files).
5. Escalate access: Use extracted database credentials to access the WordPress database directly, create admin accounts, or pivot to further compromise the hosting environment (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in filename or template parameters; requests targeting /wp-content/themes/dwell/ with unexpected query parameters.
• Logs: Web server access logs showing requests with encoded path traversal patterns or references to sensitive files (e.g., wp-config.php, passwd, .env) in query strings; repeated 200 responses to theme file endpoints from unfamiliar IPs.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system files like /etc/passwd; presence of web shells or backdoor scripts in the theme directory.
• Process: Unusual PHP processes spawning child processes or making outbound network connections from the web server process (Patchstack).

As of the Patchstack advisory, no official patch from the theme developer (axiomthemes) is available for the Dwell theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should consider replacing or disabling the Dwell theme if possible, implementing Web Application Firewall (WAF) rules to detect and block path traversal and file inclusion attempts, and monitoring server logs for suspicious activity. Network segmentation and restricting PHP file inclusion via php.ini settings (e.g., allow_url_include = Off) can reduce risk (Patchstack).

Patchstack, which discovered and disclosed the vulnerability (credited to researcher 'Bonds'), classifies it as high priority and warns it is the type of flaw exploited in mass WordPress campaigns. No significant vendor statement from axiomthemes, broader media coverage, or notable social media discussion has been identified at this time (Patchstack).