CVE-2025-60198: 
WordPress vulnerability analysis and mitigation

CVE-2025-60198 is a Local File Inclusion (LFI) vulnerability in the Saxon - Viral Content Blog & Magazine Marketing WordPress Theme developed by dedalx. It affects all versions of the theme through and including 1.9.3, allowing unauthenticated remote attackers to include and execute unauthorized PHP files on the affected WordPress installation. The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on June 22, 2025, and published by Patchstack on July 22, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — 'PHP Remote File Inclusion'), where the theme fails to properly validate or sanitize user-supplied input used in PHP file inclusion statements. An unauthenticated attacker can craft a network-based request that manipulates the file path parameter to include arbitrary local PHP files from the server's filesystem. No user interaction or authentication is required, though the attack complexity is rated High, suggesting some precondition or bypass technique may be involved. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation can result in high impacts to confidentiality, integrity, and availability of the affected WordPress site. An attacker could read sensitive local files such as wp-config.php (containing database credentials), potentially enabling full database takeover, credential theft, and complete site compromise. In scenarios where file upload functionality is available, LFI can be chained to achieve remote code execution, enabling server-level access and lateral movement within the hosting environment (Patchstack).

There is currently no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.056%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity or traffic.

• Logs: Web server access logs showing unusual GET or POST requests with file path traversal sequences (e.g., ../, %2e%2e%2f, or absolute paths) in query parameters handled by the Saxon theme.
• Logs: PHP error logs referencing unexpected file inclusion attempts or include()/require() failures for sensitive files such as /etc/passwd or wp-config.php.
• File System: Unexpected PHP web shells or newly created files in the WordPress theme directory (/wp-content/themes/saxon/).
• Network: Outbound connections from the web server process to unknown external IPs, potentially indicating post-exploitation activity.
• Process: Unusual child processes spawned by the web server (e.g., bash, curl, wget) following HTTP requests to the Saxon theme.

As of the publication date, no official patch from the theme developer (dedalx) is available for versions through 1.9.3. Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until an official fix is released. Administrators should consider deactivating and removing the Saxon theme if it is not critical to operations, implementing a Web Application Firewall (WAF) with LFI detection rules, restricting filesystem permissions to limit readable files, and monitoring for suspicious file access patterns. Upgrading to a version of the Saxon theme later than 1.9.3 is recommended once an official patch becomes available (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's Vulnerability Disclosure Program (VDP) by researcher Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity. Patchstack has classified it as high priority and noted that LFI vulnerabilities of this severity class are commonly leveraged in mass WordPress exploitation campaigns. No significant broader media coverage or notable social media commentary has been identified at this time (Patchstack).