CVE-2025-58949: 
NixOS vulnerability analysis and mitigation

CVE-2025-58949 is a PHP Local File Inclusion (LFI) vulnerability in the Spock WordPress theme developed by Axiomthemes, affecting all versions up to and including 1.17. The flaw stems from improper control of filename for include/require statements in PHP (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. The vulnerability was reported on July 31, 2025, by researcher "Bonds" and published by Patchstack on August 30, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Spock theme fails to properly sanitize or validate user-supplied input used in PHP include or require statements, enabling an attacker to manipulate the filename parameter to point to arbitrary files on the server's filesystem. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting some precondition or bypass is needed (e.g., specific server configuration or path traversal constraints). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and render arbitrary local files from the web server, potentially exposing sensitive configuration files such as wp-config.php (which contains database credentials), /etc/passwd, or other server-side files. Access to database credentials could enable complete database takeover, leading to full compromise of the WordPress site's data confidentiality and integrity. In certain server configurations, LFI can be chained with other techniques (e.g., log poisoning) to achieve remote code execution, further threatening availability (Patchstack).

As of the time of publication, no public proof-of-concept exploit exists and no active in-the-wild exploitation has been observed (Patchstack). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity.

1. Reconnaissance: Identify WordPress sites using the Spock theme (version ≤ 1.17) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source (/wp-content/themes/spock/style.css).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the unsanitized input parameter passed to a PHP include or require statement.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference a target file on the server.
4. Retrieve sensitive file contents: If successful, the server will include and render the contents of the targeted file in the HTTP response, exposing credentials or other sensitive data.
5. Escalate (optional): Chain the LFI with log poisoning or other techniques (e.g., including PHP session files containing injected code) to attempt remote code execution on misconfigured servers (Patchstack).

• Network: Unusual HTTP GET or POST requests to theme-related endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests to Spock theme PHP files with suspicious filename parameters referencing system files (e.g., wp-config.php, etc/passwd); repeated 200 responses to such requests from a single IP.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system configuration files correlating with suspicious web requests.
• Process: Unusual PHP process activity or unexpected outbound connections from the web server process if LFI is escalated to code execution via log poisoning or similar techniques.

As of the publication date, no official patch from Axiomthemes is available for the Spock theme beyond version 1.17 (Patchstack). Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: (1) Monitor the Axiomthemes repository for an updated theme version and apply it immediately when available; (2) Deploy a Web Application Firewall (WAF) or Patchstack's mitigation rule to block LFI payloads; (3) Implement strict server-side input validation and allowlisting for file inclusion paths; (4) Restrict PHP's open_basedir directive to limit accessible directories; (5) Audit web server logs for signs of exploitation attempts.

Patchstack, which coordinated the disclosure, classifies this vulnerability as high priority and warns that LFI vulnerabilities of this severity are commonly leveraged in mass-exploit campaigns against WordPress sites (Patchstack). No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified at this time.