CVE-2025-60050: 
NixOS vulnerability analysis and mitigation

CVE-2025-60050 is a Local File Inclusion (LFI) vulnerability in the Axiomthemes Panda WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Panda theme through version 1.21 and allows unauthenticated network attackers to include arbitrary local files from the server. The vulnerability was reported by researcher "Bonds" on July 20, 2025, and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Panda WordPress theme (CWE-98), which allows user-supplied input to influence which local file is included and executed. An unauthenticated remote attacker can craft a malicious HTTP request that manipulates a filename parameter to traverse the server's file system and include sensitive local files. No user interaction is required, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or parameter guessing). No public proof-of-concept code has been disclosed as of the time of publication (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files from the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), potentially enabling complete database takeover. The vulnerability carries high confidentiality, integrity, and availability impact ratings, meaning a successful attack could lead to full compromise of the affected WordPress site. Depending on server configuration, LFI may also be chained with other techniques (e.g., log poisoning) to achieve remote code execution (Patchstack).

As of the publication date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale.

1. Reconnaissance: Identify WordPress sites using the Axiomthemes Panda theme version 1.21 or earlier using tools like WPScan, Shodan, or by inspecting theme metadata in page source (/wp-content/themes/panda/style.css).
2. Identify vulnerable parameter: Analyze the theme's PHP code or observed HTTP requests to locate a filename parameter passed to a PHP include/require statement without proper sanitization.
3. Craft malicious request: Construct an HTTP GET or POST request that manipulates the vulnerable filename parameter with a path traversal payload (e.g., ../../../../wp-config.php) to reference a sensitive local file.
4. Retrieve sensitive data: Submit the crafted request to the target WordPress site; if successful, the server will include and output the contents of the targeted file (e.g., database credentials from wp-config.php).
5. Escalate access: Use retrieved credentials or other sensitive data to gain further access, such as logging into the WordPress admin panel or the database directly (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body targeting the Panda theme's endpoints.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns or references to sensitive files like wp-config.php, /etc/passwd, or PHP session files.
• File System: Unexpected file reads or access patterns on sensitive server files (detectable via file integrity monitoring or audit logs).
• Process: Unusual PHP process behavior or error log entries related to file inclusion failures, which may indicate probing attempts (Patchstack).

No official patch from the theme developer (Axiomthemes) was available as of the Patchstack publication date of August 19, 2025; the vulnerable version remains 1.21 and below. Patchstack has issued a virtual patching/mitigation rule for its users to block exploitation attempts until an official fix is released. Site administrators using the Panda theme should monitor for an updated version from Axiomthemes and apply it immediately upon release, or consider replacing the theme if no patch is forthcoming. As an interim measure, restricting access to the WordPress site via a web application firewall (WAF) or using Patchstack's mitigation rule is recommended (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher "Bonds," has rated it as high priority and warned that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No additional notable vendor statements, researcher commentary, or significant media coverage beyond the Patchstack advisory have been identified at this time (Patchstack).