CVE-2025-11746: XStore WordPress Theme RCE Vulnerability

CVE-2025-11746 Overview

The XStore theme for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 9.5.4. The flaw resides in the theet_ajax_required_plugins_popup() function, which fails to properly validate file paths before inclusion. Authenticated attackers with Subscriber-level access or above can include and execute arbitrary .php files on the server. This enables PHP code execution, access control bypass, and disclosure of sensitive data. The vulnerability is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated attackers with minimal Subscriber privileges can achieve arbitrary PHP code execution on WordPress sites running vulnerable XStore theme versions.

Affected Products

XStore theme for WordPress (8Theme)
All versions up to and including 9.5.4
WordPress installations with Subscriber-level registration enabled

Discovery Timeline

2025-10-15 - CVE-2025-11746 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-11746

Vulnerability Analysis

The vulnerability exists in the theet_ajax_required_plugins_popup() AJAX handler within the XStore theme. The function accepts user-supplied input and passes it to a PHP include or require statement without sufficient path validation. Attackers manipulate the parameter to traverse directories and load arbitrary .php files on the server.

Once included, the targeted PHP file executes within the WordPress application context. This grants attackers the same privileges as the web server process. Exploitation requires authentication, but Subscriber-level accounts are commonly obtainable through open registration on e-commerce sites that use XStore.

When combined with file upload functionality elsewhere on the host, the LFI escalates to full remote code execution. Attackers can chain the inclusion with uploaded .php payloads or log files containing injected PHP code.

Root Cause

The root cause is improper input sanitization in the theet_ajax_required_plugins_popup() function. The handler does not validate that the requested file path stays within an allowed directory or matches an expected allowlist. Path traversal sequences such as ../ and absolute paths reach the include statement unfiltered.

Attack Vector

The attack vector is network-based and requires only Subscriber-level authentication. An attacker sends a crafted AJAX request to the WordPress admin-ajax.php endpoint targeting the vulnerable action. The request includes a manipulated file path parameter pointing to the desired PHP file. The server processes the include and executes the file contents.

The vulnerability mechanism is documented in the Wordfence Vulnerability Report. No verified proof-of-concept code has been published.

Detection Methods for CVE-2025-11746

Indicators of Compromise

Unusual POST requests to /wp-admin/admin-ajax.php with action=theet_ajax_required_plugins_popup from Subscriber accounts
Path traversal sequences (../, ..%2f) in AJAX request parameters
Unexpected PHP execution from non-standard directories such as wp-content/uploads/
New or modified .php files in upload directories following Subscriber login activity

Detection Strategies

Inspect web server access logs for requests to admin-ajax.php referencing the theet_ajax_required_plugins_popup action
Monitor for HTTP requests containing directory traversal patterns targeting WordPress AJAX endpoints
Correlate Subscriber-level authentication events with subsequent file inclusion attempts
Deploy file integrity monitoring across WordPress installation directories to identify unauthorized PHP file modifications

Monitoring Recommendations

Enable verbose logging on WordPress AJAX handlers and forward to a centralized SIEM
Alert on PHP process executions spawned from web-writable directories
Track newly registered Subscriber accounts followed by AJAX activity within short time windows
Review outbound network connections from PHP-FPM or web server processes for command-and-control indicators

How to Mitigate CVE-2025-11746

Immediate Actions Required

Update the XStore theme to the latest version above 9.5.4 as released by 8Theme
Audit user accounts and remove unnecessary Subscriber registrations
Disable open user registration on WordPress sites that do not require it
Review web server logs for prior exploitation attempts targeting the vulnerable AJAX action

Patch Information

8Theme has addressed this vulnerability in versions released after 9.5.4. Administrators should consult the 8Theme Update History to identify the fixed release and apply the update through the WordPress theme management interface. Verify the installed version after upgrading.

Workarounds

Restrict access to wp-admin/admin-ajax.php by IP allowlist where feasible
Deploy a web application firewall rule to block path traversal sequences in requests to the theet_ajax_required_plugins_popup action
Set the WordPress default_role option to a non-privileged value and disable users_can_register until patched
Apply filesystem permissions that prevent the web server user from reading sensitive PHP files outside the WordPress document root

bash

# Disable open registration via wp-config.php or wp-cli
wp option update users_can_register 0
wp option update default_role subscriber

# Example WAF rule pattern (ModSecurity)
SecRule ARGS "@rx (\.\./|\.\.%2f)" \
  "id:1011746,phase:2,deny,status:403,msg:'CVE-2025-11746 LFI attempt'"