CVE-2025-60061: 
WordPress vulnerability analysis and mitigation

CVE-2025-60061 is a Local File Inclusion (LFI) vulnerability in the Axiomthemes Kicker WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Kicker theme up to and including 2.2.0, and can be exploited by unauthenticated remote attackers. The vulnerability was reported by researcher "Bonds" on July 20, 2025, and published by Patchstack on August 19, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is improper control of filenames used in PHP include/require statements within the Kicker theme (CWE-98), which allows an attacker to manipulate the file path parameter to include arbitrary local files from the server. Because no authentication is required and user-supplied input is not properly sanitized or restricted to an allowlist, a remote attacker can craft a malicious HTTP request to trigger the inclusion of sensitive server-side files. This falls under OWASP Top 10 category A3: Injection and is mapped to CAPEC-193 (PHP Remote File Inclusion) (Patchstack). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. Depending on server configuration, an attacker may also be able to execute arbitrary PHP code by including maliciously crafted files (e.g., uploaded files containing PHP), compromising the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability poses a risk of privilege escalation and lateral movement within the hosting environment if credentials or other sensitive data are exposed (Patchstack).

No public proof-of-concept exploit or evidence of active in-the-wild exploitation has been observed as of the time of publication (Patchstack). The vulnerability requires no authentication and no user interaction, lowering the barrier for exploitation. The EPSS score is approximately 0.15%, indicating a currently low but non-negligible probability of exploitation in the near term. Patchstack has flagged this as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites using the Kicker theme (version ≤ 2.2.0) via web crawlers, Shodan, WPScan, or similar tools that enumerate WordPress theme metadata.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate the file inclusion parameter that accepts user-controlled input for include/require statements.
3. Craft malicious request: Send a crafted HTTP GET or POST request to the vulnerable endpoint with a manipulated file path parameter (e.g., ?file=../../../../wp-config.php) to traverse directories and target sensitive files.
4. Extract sensitive data: Review the server response for the contents of included files such as wp-config.php (database credentials), /etc/passwd, or other sensitive configuration files.
5. Escalate if possible: If the server allows inclusion of uploaded files (e.g., images with embedded PHP), attempt to include a previously uploaded malicious file to achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing directory traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body fields.
• Logs: Web server access logs showing requests with path traversal patterns targeting known sensitive files (e.g., wp-config.php, /etc/passwd); repeated 200 OK responses to such requests may indicate successful exploitation.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php; presence of newly uploaded files (e.g., images) containing embedded PHP code in the WordPress uploads directory.
• Process: Unusual PHP processes spawned by the web server user; unexpected outbound connections from the web server process.

As of the publication date, no official patch from Axiomthemes is available for the Kicker theme. Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts until an official fix is released (Patchstack). Recommended interim mitigations include: implementing strict input validation and allowlisting for file inclusion operations, configuring PHP to disable allow_url_include, deploying a Web Application Firewall (WAF) with rules to detect and block LFI attempts, and auditing the theme's file inclusion logic. Site owners should monitor for an official patched release beyond version 2.2.0 and apply it promptly upon availability.

Patchstack, which discovered and disclosed the vulnerability, has classified it as high priority and noted that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites (Patchstack). No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified at this time.