CVE-2025-64193: 
WordPress vulnerability analysis and mitigation

CVE-2025-64193 is a Local File Inclusion (LFI) vulnerability in the 8theme XStore WordPress theme that allows authenticated attackers with Subscriber-level privileges to include arbitrary local files on the server. It affects XStore versions prior to 9.6.1 and was reported by researcher Rafie Muhammad on August 11, 2025, with public disclosure on September 10, 2025. The CVE was formally published on December 18, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when user-supplied input is used unsanitized in PHP include or require statements within the XStore theme. An authenticated attacker with at minimum Subscriber-level access can manipulate a filename parameter to cause the server to include arbitrary local files, exposing their contents. The attack vector is network-based, requires low privileges, no user interaction, but has high attack complexity (Patchstack, Feedly).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, exposure of secret keys, and potentially further compromise of the WordPress installation and underlying server. The confidentiality, integrity, and availability impacts are all rated High (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported as of the time of disclosure. The EPSS score is approximately 0.053%, indicating a currently low probability of exploitation in the near term. Patchstack classifies this as High priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale. The vulnerability requires at least Subscriber-level authentication, which somewhat limits opportunistic exploitation but does not eliminate risk on sites with open registration (Patchstack).

1. Reconnaissance: Identify WordPress sites running the XStore theme (versions < 9.6.1) using tools like WPScan, Shodan, or by inspecting theme metadata in page source.
2. Account Registration: Register or obtain a Subscriber-level account on the target WordPress site (requires open user registration or compromised credentials).
3. Identify Vulnerable Parameter: Locate the theme functionality that accepts a filename or path parameter used in a PHP include/require statement — typically exposed via an AJAX handler or front-end template loader.
4. Craft Malicious Request: Submit an authenticated HTTP request with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php) to trigger the LFI.
5. Extract Sensitive Data: Review the server response for the contents of the included file, extracting database credentials, secret keys, or other sensitive configuration data for further exploitation (Patchstack).

• Network: Authenticated HTTP requests containing path traversal sequences (e.g., ../, ..%2F) in parameters associated with XStore theme AJAX endpoints or template loaders.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting theme-related endpoints from Subscriber-level authenticated sessions.
• File System: Unexpected access to sensitive files such as wp-config.php, .env, or system files (e.g., /etc/passwd) reflected in PHP error logs or access logs.
• Process: PHP error log entries indicating failed or successful file inclusion of paths outside the theme directory.

The vulnerability is patched in XStore version 9.6.1. All users of the XStore WordPress theme should update to version 9.6.1 or later immediately. As an interim measure, Patchstack has issued a virtual patching/mitigation rule for subscribers of its service to block exploitation attempts until the theme is updated. Site administrators should also consider disabling open user registration if not required, to reduce the pool of potential attackers (Patchstack).

The vulnerability was discovered and responsibly disclosed by Patchstack researcher Rafie Muhammad, who reported it on August 11, 2025. Patchstack has classified it as High priority and issued a mitigation rule for its platform users. No significant broader media coverage or notable social media discussion has been identified beyond the Patchstack advisory (Patchstack).