CVE-2025-60066: 
WordPress vulnerability analysis and mitigation

CVE-2025-60066 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes Katelyn WordPress theme affecting all versions up to and including 1.0.10. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98). It was reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity on July 5, 2025, and publicly disclosed by Patchstack on August 4, 2025. It carries a CVSS v3.1 base score of 8.1 (High) and requires no authentication or user interaction to exploit (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Katelyn theme fails to properly sanitize or validate user-supplied input before using it in PHP file inclusion functions, allowing an unauthenticated remote attacker to manipulate the filename parameter to include arbitrary local files from the server's filesystem. The attack vector is network-based with high attack complexity, requiring no privileges or user interaction. Exploitation could expose sensitive server-side files such as configuration files containing database credentials (Patchstack).

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, including sensitive configuration files (e.g., wp-config.php) that may contain database credentials, API keys, and other secrets. This could lead to complete database takeover, credential theft, and potential escalation to remote code execution if combined with file upload capabilities or other vulnerabilities. The CVSS scoring reflects high impacts to confidentiality, integrity, and availability (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires no authentication, making it accessible to any network-based attacker, though the high attack complexity rating suggests some conditions must be met. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Katelyn theme (version <= 1.0.10) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's PHP file inclusion mechanism — identify the parameter or endpoint that accepts a filename or path value passed to a PHP include() or require() function.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
4. Retrieve sensitive data: If successful, the server returns the contents of the included file (e.g., wp-config.php), exposing database credentials, authentication keys, and salts.
5. Escalate access: Use extracted credentials to access the WordPress database directly or the admin panel, enabling full site compromise or lateral movement within the hosting environment (Patchstack).

• Network: Unusual HTTP GET or POST requests to theme-related endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests with encoded traversal patterns targeting WordPress theme files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files reflected in PHP error logs or access logs.
• Process: PHP processes reading files outside the WordPress web root, particularly configuration or credential files, as observed in server-side monitoring or file integrity tools.

As of the disclosure date, no official patch from the theme developer (Axiomthemes) is available for the Katelyn theme. Users should update to a patched version as soon as one is released. In the interim, Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts. Additional workarounds include: disabling or replacing the Katelyn theme with a supported alternative, implementing a Web Application Firewall (WAF) rule to block path traversal patterns, enforcing strict input validation on file inclusion paths at the server level, and applying the principle of least privilege to the web server process (Patchstack).

The vulnerability was discovered and disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity through Patchstack's responsible disclosure program. Patchstack classified it as high priority, noting that LFI vulnerabilities of this type are frequently leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).