CVE-2025-60053: 
WordPress vulnerability analysis and mitigation

CVE-2025-60053 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes MaxCube WordPress theme, affecting all versions up to and including 1.3.1. The flaw allows unauthenticated remote attackers to manipulate file include/require statements to read arbitrary files on the server. It was reported by researcher "Bonds" on July 20, 2025, and published by Patchstack on August 19, 2025. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) per NVD, and 8.1 (High) per Patchstack (Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly associated with PHP Remote/Local File Inclusion. The MaxCube theme fails to properly validate or sanitize user-supplied input used in PHP include or require statements, allowing an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires no authentication and can be performed remotely over the network with low attack complexity. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated attacker to read arbitrary files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This poses a high confidentiality risk and could lead to complete database compromise or further lateral movement within the hosting environment. Integrity impact is rated low, and there is no direct availability impact (Patchstack).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been observed as of the time of publication. The EPSS score is approximately 0.053%, indicating a currently low probability of exploitation in the near term. However, Patchstack classifies this as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the MaxCube theme (version ≤ 1.3.1) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion endpoint or parameter that accepts user-controlled input for file path resolution (e.g., a template or page parameter in a theme file).
3. Craft LFI payload: Construct an HTTP request with a manipulated file path parameter using directory traversal sequences (e.g., ../../../../wp-config.php) targeting sensitive files.
4. Send request: Submit the crafted request to the vulnerable WordPress site without any authentication credentials.
5. Retrieve sensitive data: If successful, the server response will include the contents of the targeted file (e.g., database credentials from wp-config.php), which can be used for further compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing directory traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or request bodies.
• Logs: Web server access logs showing requests to MaxCube theme PHP files with file path manipulation patterns; repeated 200 responses to requests containing traversal strings targeting /wp-config.php, /etc/passwd, or similar sensitive files.
• File System: No direct file system artifacts expected from read-only LFI exploitation; however, if chained with other vulnerabilities, watch for new or modified PHP files in the theme or uploads directory.
• Process: Unexpected outbound connections from the web server process following suspicious theme file requests, which may indicate chained exploitation.

As of the publication date, no official patch from AncoraThemes is available for the MaxCube theme beyond version 1.3.1. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: removing or replacing the MaxCube theme if possible, implementing strict input validation and allow-lists for file inclusion operations at the application or WAF level, applying the principle of least privilege to web server file permissions, and monitoring access logs for traversal patterns. Users of Patchstack can leverage the automated mitigation rule as an interim measure (Patchstack).

Patchstack, which assigned and disclosed this CVE, classifies it as high priority and warns that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No notable independent researcher commentary, vendor statements from AncoraThemes, or significant media coverage has been identified beyond the Patchstack advisory (Patchstack).