CVE-2025-63076: 
WordPress vulnerability analysis and mitigation

CVE-2025-63076 is a Local File Inclusion (LFI) vulnerability in the Dream-Theme The7 Elements WordPress plugin (dt-the7-core), classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of The7 Elements up to and including 2.7.11, and was patched in version 2.7.12. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on September 5, 2025, and published by Patchstack on October 5, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is improper sanitization of user-supplied input used in PHP include/require statements within the dt-the7-core plugin, classified as CWE-98. An attacker with at least Contributor- or Developer-level WordPress privileges can manipulate a filename parameter to cause the server to include arbitrary local files. This is a network-based attack with high complexity, requiring low privileges but no user interaction, and the scope remains unchanged. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, exposure of secret keys, and potentially further compromise of the WordPress installation and underlying server. Confidentiality, integrity, and availability are all rated as high impact in the CVSS scoring (Patchstack).

No active in-the-wild exploitation has been confirmed, and no exploit kits or weaponized code are publicly known at this time. The EPSS score is approximately 0.147%, indicating a low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat currently observed, though they note that LFI vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running The7 Elements plugin version ≤ 2.7.11 using tools like WPScan, Shodan, or by inspecting plugin directories exposed via the web server.
2. Obtain required privileges: Gain Contributor or Developer-level access to the target WordPress site (e.g., via credential stuffing, phishing, or registration if open).
3. Identify vulnerable parameter: Locate the plugin functionality that accepts a filename or path parameter passed to a PHP include/require statement within the dt-the7-core plugin.
4. Craft LFI payload: Submit a crafted request with a path traversal sequence (e.g., ../../../../wp-config.php) in the vulnerable parameter to force the server to include a sensitive local file.
5. Retrieve sensitive data: Observe the server response for the contents of the included file (e.g., database credentials from wp-config.php), then use those credentials for further lateral movement or database access (Patchstack).

• Network: Unusual HTTP requests to WordPress plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameters associated with the dt-the7-core plugin.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting The7 Elements plugin endpoints; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files reflected in PHP error logs or access logs.
• Process: PHP error log entries referencing failed or successful include/require calls with user-controlled paths from within the dt-the7-core plugin directory.

The vendor has released version 2.7.12 of The7 Elements plugin, which patches this vulnerability. All users running version 2.7.11 or earlier should update immediately via the WordPress admin dashboard or by downloading the patched version. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restrict Contributor and Developer role registrations and consider using a web application firewall (WAF) rule to block path traversal patterns in plugin requests (Patchstack).