CVE-2025-64363: 
WordPress vulnerability analysis and mitigation

CVE-2025-64363 is a Local File Inclusion (LFI) vulnerability in the SeventhQueen Kleo WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all Kleo theme versions prior to 5.5.0 and was reported by researcher João Pedro S Alcântara (Kinorth) on September 30, 2025, with public disclosure on October 31, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assessed by CISA-ADP (Patchstack, ENISA EUVD).

The vulnerability stems from improper validation of user-controlled input used in PHP include/require statements within the Kleo theme (CWE-98), allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server's filesystem. Exploitation requires low privileges — specifically Contributor or Developer-level WordPress access — and high attack complexity, meaning some preconditions or non-default configurations must be met. No public proof-of-concept exploit code has been identified at this time. The vulnerability was discovered and reported through Patchstack's Vulnerability Disclosure Program (Patchstack).

Successful exploitation allows an authenticated attacker to read arbitrary local files on the web server, potentially exposing sensitive configuration files such as wp-config.php (containing database credentials), environment files, or other server-side resources. This could lead to full database compromise, credential theft, and further lateral movement within the hosting environment. The confidentiality, integrity, and availability impacts are all rated High in the CVSS assessment (Patchstack, ENISA EUVD).

No active in-the-wild exploitation has been reported, and no public exploit code or weaponized tooling is currently known. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the vulnerability type being associated with mass-exploit campaigns (Patchstack, Wordfence).

1. Reconnaissance: Identify WordPress sites using the Kleo theme (versions < 5.5.0) via HTTP response headers, theme file paths (e.g., /wp-content/themes/kleo/), or tools like WPScan.
2. Obtain low-privilege access: Authenticate to the target WordPress site with at least Contributor or Developer-level credentials, which are required for exploitation.
3. Identify vulnerable parameter: Locate the theme functionality that accepts a filename or path parameter passed to a PHP include/require statement without proper sanitization.
4. Craft LFI payload: Submit a crafted request with a manipulated filename parameter (e.g., path traversal sequences like ../../../../wp-config.php) to force the server to include a sensitive local file.
5. Retrieve sensitive data: Observe the server response for the contents of the included file, such as database credentials from wp-config.php, which can then be used for further compromise (Patchstack).

• Logs: WordPress access logs showing requests to Kleo theme endpoints with path traversal sequences (e.g., ../, %2e%2e%2f) in query parameters or POST body data.
• Logs: PHP error logs referencing unexpected file inclusion attempts or include/require failures for files outside the theme directory.
• Network: Authenticated HTTP requests from unexpected IP addresses targeting Kleo theme-specific endpoints with anomalous filename parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, .env, or server configuration files correlating with suspicious request times.

The vendor SeventhQueen has released Kleo version 5.5.0, which patches this vulnerability. All users running Kleo versions prior to 5.5.0 should update immediately to version 5.5.0 or later. No configuration-based workaround is documented; upgrading is the only recommended remediation. Additionally, restricting Contributor/Developer-level account creation and enforcing strong authentication can reduce the attack surface (Patchstack).

Wordfence included CVE-2025-64363 in its weekly WordPress vulnerability report for the period of October 27–November 2, 2025, noting it as part of the broader landscape of WordPress theme vulnerabilities (Wordfence). Patchstack, the disclosing organization, rated the vulnerability as low priority and noted it is unlikely to be exploited in practice despite the LFI class being associated with mass-exploit campaigns (Patchstack). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.