CVE-2025-60055: 
WordPress vulnerability analysis and mitigation

CVE-2025-60055 is a Local File Inclusion (LFI) vulnerability in the Fabrica WordPress theme by AncoraThemes, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Fabrica theme up to and including 1.8.1, and can be exploited remotely by unauthenticated attackers without user interaction. The vulnerability was reported by security researcher "Bonds" on July 20, 2025, and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.2 (High) per NVD, and 8.1 (High) per Patchstack (Patchstack).

The root cause is improper validation of user-supplied input used in PHP include/require statements within the Fabrica theme, classified as CWE-98. An attacker can manipulate a filename parameter to cause the PHP interpreter to include arbitrary local files from the server's filesystem, exposing their contents. Because no authentication or user interaction is required and the attack vector is network-accessible with low complexity, exploitation is straightforward for any remote attacker. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), /etc/passwd, and other system files. This can lead to full database compromise, credential theft, and potential escalation to remote code execution if the attacker can chain the LFI with file upload or log poisoning techniques. The confidentiality impact is rated High, with a Low availability impact, and no direct integrity impact (Patchstack).

No public proof-of-concept exploit has been observed, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a currently low probability of exploitation in the near term. Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites regardless of traffic or popularity, and has issued a virtual patch/mitigation rule for its users. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Fabrica theme (version ≤ 1.8.1) via passive scanning tools (e.g., WPScan, Shodan, or Google dorks such as inurl:wp-content/themes/fabrica).
2. Identify vulnerable parameter: Analyze the Fabrica theme's PHP source code or HTTP responses to locate parameters passed to include/require statements without proper sanitization.
3. Craft malicious request: Send an unauthenticated HTTP request to the target WordPress site with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Retrieve file contents: The server processes the crafted include path and returns the contents of the targeted file in the HTTP response, exposing credentials or system information.
5. Escalate access: Use extracted database credentials from wp-config.php to access the WordPress database directly, create admin accounts, or chain with other vulnerabilities for remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme files containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; requests returning contents of system files.
• Logs: Web server access logs showing requests to Fabrica theme PHP files with suspicious filename parameters containing traversal patterns; HTTP 200 responses to requests that include /etc/passwd, wp-config.php, or similar sensitive file paths.
• File System: No direct file system artifacts expected from read-only LFI, but watch for newly created files if LFI is chained with file upload for RCE.
• Application Logs: WordPress error logs showing PHP include/require errors or warnings referencing unexpected file paths outside the theme directory.

As of the publication date, no official patch from AncoraThemes has been released for the Fabrica theme. Site owners should update the theme to any version beyond 1.8.1 if available, or consider replacing the theme with a supported alternative. Patchstack has issued a virtual patching/mitigation rule for its subscribers that blocks exploitation attempts until an official fix is available. Additional hardening measures include implementing strict input validation for file paths, using allowlists for permitted file inclusions, restricting PHP's open_basedir directive, and monitoring web application logs for suspicious file access patterns (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher "Bonds," has classified it as high priority and noted that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant vendor statement from AncoraThemes or broader media coverage has been identified at this time (Patchstack).