CVE-2025-60054: 
WordPress vulnerability analysis and mitigation

CVE-2025-60054 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes OnLeash WordPress theme, caused by improper control of filename parameters in PHP include/require statements. It affects OnLeash versions up to and including 1.5.2, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by researcher "Bonds" on July 20, 2025, and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is insufficiently validated before being used in PHP include or require statements within the OnLeash theme. This allows an attacker to manipulate the filename parameter to reference arbitrary local files on the server, causing their contents to be read and potentially rendered. Exploitation requires no authentication and no user interaction, though attack complexity is rated High, suggesting specific conditions or knowledge of the target environment are needed (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), potentially enabling complete database takeover. The vulnerability carries high confidentiality, integrity, and availability impacts — attackers could expose credentials, manipulate content, or disrupt service. The OWASP classification is A3: Injection, and the attack is network-accessible without requiring user interaction (Patchstack).

As of the time of publication, no public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the OnLeash theme (version ≤ 1.5.2) via web crawlers, Shodan, WPScan, or similar tools that enumerate WordPress theme metadata.
2. Identify vulnerable parameter: Locate the theme's PHP include/require statement that accepts user-controlled filename input — typically exposed via a URL query parameter or POST field processed by the theme's front-end logic.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../wp-config.php or /etc/passwd) in the vulnerable filename parameter to reference a target local file.
4. Send malicious request: Submit the crafted HTTP request to the target WordPress site without authentication. If successful, the server will include and render the contents of the specified local file in the HTTP response.
5. Extract sensitive data: Parse the response for credentials (e.g., database username/password from wp-config.php), which can then be used for database access, privilege escalation, or further lateral movement (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; requests targeting sensitive files such as wp-config.php or /etc/passwd.
• Logs: Web server access logs showing repeated requests with encoded or plain path traversal strings to OnLeash theme URLs; HTTP 200 responses to requests containing file path patterns.
• File System: No direct file system artifacts expected from read-only LFI, but monitor for subsequent unauthorized database access or new admin accounts created using extracted credentials.
• Application: WordPress audit logs showing unexpected admin account creation or configuration changes following suspicious theme requests.

As of the publication date, no official patch from AncoraThemes is available for OnLeash beyond version 1.5.2. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site owners should consider temporarily deactivating the OnLeash theme if no patch is available, implementing a Web Application Firewall (WAF) with rules to detect path traversal patterns, and restricting file system permissions to limit exposure. Monitor for an official update from AncoraThemes and apply it immediately upon release (Patchstack).