CVE-2025-60067: 
WordPress vulnerability analysis and mitigation

CVE-2025-60067 is a Local File Inclusion (LFI) vulnerability in the Giardino WordPress theme developed by Axiomthemes, affecting all versions up to and including 1.1.10. The flaw stems from improper control of filename for include/require statements in PHP (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files on the server. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on July 5, 2025, and publicly disclosed by Patchstack on August 4, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which manifests when user-supplied input is passed unsanitized to PHP file inclusion functions such as include() or require(). An unauthenticated attacker can craft a malicious HTTP request that manipulates the filename parameter to traverse the file system and include sensitive local files. Exploitation requires high attack complexity (e.g., specific conditions or race conditions must be met), but no authentication or user interaction is needed. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as WordPress wp-config.php (which contains database credentials), /etc/passwd, and other system files. This can lead to full database compromise, credential theft, and potentially remote code execution if the server configuration permits inclusion of attacker-controlled content (e.g., via log poisoning or uploaded files). The vulnerability has high confidentiality, integrity, and availability impacts per its CVSS scoring (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites regardless of their traffic or popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Giardino theme (version ≤ 1.1.10) via passive scanning tools (e.g., WPScan, Shodan, or Google dorks such as inurl:wp-content/themes/giardino).
2. Identify vulnerable parameter: Analyze the theme's PHP source code or HTTP responses to locate parameters passed to PHP file inclusion functions (include, require, include_once, require_once) without proper sanitization.
3. Craft malicious request: Construct an HTTP GET or POST request targeting the vulnerable endpoint, injecting a path traversal payload (e.g., ../../../../wp-config.php or ../../../../etc/passwd) into the vulnerable filename parameter.
4. Retrieve sensitive files: Submit the crafted request to the target server; if successful, the server returns the contents of the included file in the HTTP response, exposing credentials or system information.
5. Escalate access: Use exposed database credentials from wp-config.php to access the WordPress database directly, create admin accounts, or pivot to further compromise the hosting environment (Patchstack).

• Network: Unusual HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body targeting Giardino theme endpoints; unexpected outbound connections from the web server to unknown hosts.
• Logs: Web server access logs showing requests with encoded traversal patterns (e.g., %2e%2e, %252e) to theme-related PHP files; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or PHP session files; presence of web shells in the theme directory or uploads folder.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) that may indicate successful code execution following LFI exploitation via log poisoning or similar techniques (Patchstack).

As of the disclosure date, no official patch from the theme developer (Axiomthemes) is available for the Giardino theme. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Recommended actions include: (1) immediately deploying Patchstack's mitigation rule or a Web Application Firewall (WAF) with LFI blocking rules; (2) restricting file system permissions to limit what files the web server process can read; (3) monitoring for suspicious file access patterns; and (4) considering replacing the theme with a supported alternative if no patch is forthcoming (Patchstack).

The vulnerability was discovered and disclosed by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity through Patchstack's responsible disclosure program. Patchstack has classified it as high priority and noted the potential for mass-exploit campaigns targeting WordPress sites. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).