CVE-2025-60047: 
WordPress vulnerability analysis and mitigation

CVE-2025-60047 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes IPharm WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement). It affects IPharm versions up to and including 1.2.3 and can be exploited by unauthenticated remote attackers. The vulnerability was reported by security researcher "Bonds" on July 20, 2025, and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability stems from improper control of filenames used in PHP include/require statements within the IPharm WordPress theme (CWE-98), allowing an attacker to manipulate file path parameters to include arbitrary local files on the server. Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). The flaw is classified under OWASP Top 10 A3: Injection and is network-accessible, meaning it can be triggered remotely via crafted HTTP requests (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), potentially enabling complete database takeover. Depending on server configuration, LFI can be chained with other techniques (e.g., log poisoning) to achieve remote code execution, compromising the confidentiality, integrity, and availability of the affected WordPress site. The CVSS score reflects high impact across all three security dimensions (Patchstack).

As of the time of publication, no public proof-of-concept exploit code has been observed, and there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the IPharm theme (version ≤ 1.2.3) via web crawlers, Shodan, WPScan, or similar tools that enumerate WordPress theme metadata.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate a file inclusion parameter that accepts user-controlled input (e.g., a template, file, or page parameter in a theme function).
3. Craft malicious request: Send a crafted HTTP GET or POST request to the vulnerable endpoint with a manipulated file path value, such as ../../../../wp-config.php or /etc/passwd, to traverse the directory structure.
4. Retrieve sensitive files: If successful, the server returns the contents of the included file in the HTTP response, exposing credentials, configuration data, or other sensitive information.
5. Escalate (optional): Use exposed database credentials from wp-config.php to access the WordPress database directly, or chain the LFI with log poisoning or other techniques to achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests containing directory traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body targeting IPharm theme endpoints; repeated requests to theme PHP files with unexpected file path parameters.
• Logs: Web server access logs showing requests with path traversal patterns (e.g., GET /wp-content/themes/ipharm/...?file=../../../../wp-config.php); HTTP 200 responses to requests containing traversal sequences.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or server log files that correlate with suspicious web requests.
• Process: Unusual PHP process activity or unexpected outbound connections from the web server process if LFI is chained with code execution techniques.

As of the publication date, no official patch from the theme developer (Axiomthemes) is available for IPharm beyond version 1.2.3. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should consider removing or replacing the IPharm theme if a patched version is not available, implementing a Web Application Firewall (WAF) rule to block directory traversal patterns, and applying strict input validation for any file inclusion logic. Additionally, restricting PHP's allow_url_include and open_basedir settings can limit the impact of LFI vulnerabilities (Patchstack).