CVE-2025-60060: 
WordPress vulnerability analysis and mitigation

CVE-2025-60060 is a PHP Local File Inclusion (LFI) vulnerability in the Pubzinne WordPress theme developed by Axiomthemes, affecting all versions up to and including 1.0.12. The flaw stems from improper control of filename for include/require statements (CWE-98), allowing unauthenticated remote attackers to manipulate file inclusion mechanisms. The vulnerability was reported by researcher "Bonds" on July 20, 2025, and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion attacks. An unauthenticated attacker can send a crafted network request that manipulates unsanitized input passed to a PHP include or require statement within the Pubzinne theme, causing the server to include arbitrary local files. The attack vector is network-based with high attack complexity and requires no user interaction or privileges. No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an attacker to read sensitive files on the server, such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. Attackers may also include malicious PHP files already present on the server to achieve arbitrary code execution, potentially compromising the full integrity and availability of the WordPress site. The vulnerability affects confidentiality, integrity, and availability at a high level, and could facilitate lateral movement within the hosting environment if shared hosting configurations are in place (Patchstack).

No public proof-of-concept exploit code is currently known, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.0015 (0.15%), indicating a low current probability of exploitation. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Pubzinne theme (version ≤ 1.0.12) via tools like WPScan, Shodan, or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable parameter: Locate theme functionality that accepts user-controlled input passed to a PHP include or require statement, typically via GET/POST parameters in theme template files.
3. Craft malicious request: Send a crafted HTTP request with a manipulated file path parameter (e.g., path traversal sequences like ../../../../wp-config.php) targeting the vulnerable include mechanism.
4. Read sensitive files: If successful, the server returns the contents of the targeted local file (e.g., wp-config.php), exposing database credentials and authentication keys.
5. Escalate access: Use extracted credentials to access the WordPress database directly, log in to the WordPress admin panel, or attempt further exploitation such as uploading a web shell for remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) or references to sensitive files like wp-config.php, /etc/passwd, or similar.
• Logs: Web server access logs showing requests with encoded or plaintext directory traversal patterns targeting Pubzinne theme files; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected web shells or PHP files written to the WordPress uploads directory or theme directory; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI exploitation.

As of the publication date, no official patch from Axiomthemes is available for the Pubzinne theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploit attempts until an official fix is released. Recommended actions include: immediately applying Patchstack's mitigation rule if subscribed; implementing a Web Application Firewall (WAF) with rules to block path traversal and LFI patterns; enforcing strict input validation and allowlisting for file inclusion parameters; limiting file system permissions for the web application user; and monitoring for a vendor-released patch to apply as soon as available (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher "Bonds," has classified it as high priority and noted that LFI vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. No significant vendor statement from Axiomthemes, broader media coverage, or notable social media discussion has been identified at this time (Patchstack).