CVE-2025-58946: 
NixOS vulnerability analysis and mitigation

CVE-2025-58946 is a PHP Local File Inclusion (LFI) vulnerability in the axiomthemes Vocal WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Vocal theme up to and including version 1.12, and can be exploited by unauthenticated remote attackers over the network. The vulnerability was reported by security researcher "Bonds" on August 3, 2025, and published by Patchstack on September 2, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper validation and sanitization of user-supplied input used in PHP include/require statements within the Vocal WordPress theme (CWE-98). An attacker can manipulate filename parameters passed to these PHP file inclusion functions to reference arbitrary local files on the server's filesystem, bypassing intended access controls. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). The vulnerability is classified under OWASP Top 10 A3: Injection (Patchstack).

Successful exploitation allows a remote, unauthenticated attacker to read arbitrary local files from the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), /etc/passwd, and other system files. Access to database credentials could enable complete database takeover, exposure of user data, and potential escalation to full site compromise. The CVSS scoring reflects high impact to confidentiality, integrity, and availability (Patchstack).

As of the time of publication, no public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.053%, indicating a low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity.

1. Reconnaissance: Identify WordPress sites using the Vocal theme (version ≤ 1.12) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed to include/require statements without proper sanitization.
3. Craft LFI payload: Construct an HTTP request targeting the vulnerable endpoint with a manipulated filename parameter, such as path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Send unauthenticated request: Submit the crafted request to the target WordPress site without any authentication credentials.
5. Retrieve sensitive data: If successful, the server response will include the contents of the targeted file (e.g., database credentials from wp-config.php), which can be used for further compromise such as database access or lateral movement (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests to Vocal theme PHP files with suspicious filename parameters referencing system files (e.g., wp-config.php, /etc/passwd); HTTP 200 responses to such requests may indicate successful exploitation.
• File System: Unexpected new files (e.g., web shells) written to the WordPress theme or uploads directory if LFI is chained with a file upload vulnerability.
• Process: Unusual PHP process activity or error log entries in php_error.log related to failed or successful file inclusion of paths outside the web root.

As of the publication date, no official patch from the theme developer (axiomthemes) is available for the Vocal theme beyond version 1.12 (Patchstack). Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should consider switching to an alternative theme, restricting access to the WordPress site, or deploying a Web Application Firewall (WAF) rule to block path traversal patterns in requests. Contacting the theme developer or hosting provider for assistance is also recommended.

Patchstack, which assigned and published this CVE, has rated it as high priority and noted that LFI vulnerabilities of this class are commonly leveraged in mass-exploit campaigns against WordPress sites (Patchstack). No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified at this time.