CVE-2025-60052: 
WordPress vulnerability analysis and mitigation

CVE-2025-60052 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes W&D WordPress theme, affecting all versions up to and including 1.0. The flaw stems from improper control of filename for include/require statements in PHP (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files. The vulnerability was reported on July 20, 2025, by researcher "Bonds" and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.1–8.2 (High) with no authentication required for exploitation (Patchstack, Feedly).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when user-supplied input is passed unsanitized to PHP include() or require() statements within the W&D theme. An unauthenticated attacker can craft a malicious HTTP request that manipulates the file path parameter to traverse the server's file system and include arbitrary local files. No special privileges or user interaction are required, and the attack is conducted entirely over the network with low complexity. The OWASP Top 10 classification for this vulnerability is A3: Injection (Patchstack).

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the server, including sensitive configuration files such as WordPress wp-config.php (which contains database credentials), /etc/passwd, and other system files. This can lead to full database compromise, credential theft, and exposure of confidential system information. While the primary impact is on confidentiality (rated High) and integrity (rated Low), a successful LFI attack could also serve as a stepping stone for remote code execution if combined with log poisoning or other file upload techniques (Patchstack, Feedly).

As of the time of publication, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as "High" priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the AncoraThemes W&D theme (version <= 1.0) via web crawlers, Shodan, WPScan, or similar tools by fingerprinting theme-specific assets or metadata.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion endpoint — typically a template or page parameter that accepts a filename or path value without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP GET or POST request to the vulnerable endpoint with a manipulated file path, such as ?template=../../../../wp-config.php or similar path traversal sequences.
4. Extract sensitive data: Review the server's response for the contents of the included file (e.g., database credentials from wp-config.php, system user information from /etc/passwd).
5. Escalate (optional): If the server is misconfigured or log files are accessible, attempt log poisoning by injecting PHP code into server logs and then including the log file to achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters; requests targeting sensitive files like wp-config.php or /etc/passwd.
• Logs: Web server access logs (Apache/Nginx) showing repeated GET/POST requests with encoded path traversal strings to theme-related PHP files; HTTP 200 responses to requests containing file path parameters that should not accept such input.
• File System: Unexpected new PHP files or web shells in the WordPress theme directory (/wp-content/themes/wd/); modifications to existing theme files.
• Application: WordPress error logs showing PHP include() or require() failures for unusual file paths; unexpected database credential exposure or unauthorized database access following exploitation.

As of the publication date, no official patch is available from AncoraThemes for the W&D theme (Patchstack). Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: (1) replacing the W&D theme with an actively maintained alternative; (2) deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns; (3) implementing strict file system permissions to limit what files the web server process can read; and (4) using allowlists for any permitted file inclusion paths in PHP code.

Patchstack, which discovered and disclosed the vulnerability, has classified it as high priority and noted that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No additional notable vendor statements, researcher commentary, or significant media coverage has been identified at this time (Patchstack).