CVE-2025-4200: Zagg WordPress Theme RCE Vulnerability

CVE-2025-4200 Overview

CVE-2025-4200 is a Local File Inclusion (LFI) vulnerability in the Zagg - Electronics & Accessories WooCommerce WordPress Theme. The flaw affects all theme versions up to and including 1.4.1. The vulnerability resides in the load_view() function, which is invoked through at least three AJAX actions: load_more_post, load_shop, and load_more_product.

Unauthenticated attackers can exploit this weakness to include and execute arbitrary files on the server. Successful exploitation allows execution of any PHP code contained in those files. The issue is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program).

Critical Impact
Unauthenticated remote attackers can include arbitrary PHP files to bypass access controls, exfiltrate sensitive data, or achieve remote code execution when combined with file upload primitives.

Affected Products

Zagg - Electronics & Accessories WooCommerce WordPress Theme versions ≤ 1.4.1
WordPress sites using the vulnerable theme with AJAX endpoints exposed
Any deployment permitting uploads of images or other file types that may be included by the theme

Discovery Timeline

2025-06-14 - CVE-2025-4200 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-4200

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied input passed to the load_view() function inside the theme. This function constructs a file path used in a PHP include or require statement without sanitizing or restricting traversal sequences. Attackers control the filename parameter through the AJAX endpoints load_more_post, load_shop, and load_more_product.

Because WordPress exposes the admin-ajax.php endpoint to unauthenticated visitors when actions are registered with wp_ajax_nopriv_, the attack requires no credentials. The included PHP file executes within the WordPress process, inheriting its permissions and database access.

The high attack complexity reflected in the score relates to the need to identify or stage a target file containing attacker-controlled PHP. When attackers can upload images or other media types that the server stores with predictable paths, they can chain that primitive with this LFI to achieve full remote code execution.

Root Cause

The root cause is missing input validation on a parameter used to build an include path. The load_view() function trusts client-supplied values without applying an allowlist of permitted view names, path canonicalization, or restriction to a specific directory.

Attack Vector

An unauthenticated attacker sends a crafted POST request to wp-admin/admin-ajax.php specifying one of the vulnerable action values and a malicious view parameter. The parameter contains directory traversal sequences or absolute paths pointing at attacker-controlled or sensitive files. PHP then includes the referenced file and executes any code within it.

The vulnerability mechanism is documented in the Wordfence Vulnerability Report and theme details are available on the ThemeForest Product Overview.

Detection Methods for CVE-2025-4200

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=load_more_post, action=load_shop, or action=load_more_product with path traversal patterns such as ../ in request parameters
Unexpected PHP execution from media directories such as wp-content/uploads/
Web shell artifacts, modified theme files, or new administrator accounts created shortly after AJAX requests
Outbound connections from the PHP-FPM or web server process to attacker-controlled infrastructure

Detection Strategies

Inspect web access logs for AJAX requests matching the three vulnerable actions paired with suspicious filename parameters
Deploy WAF rules that block directory traversal sequences and absolute paths in POST bodies destined for admin-ajax.php
Monitor PHP include/require activity through application instrumentation or runtime application self-protection tooling

Monitoring Recommendations

Enable file integrity monitoring across wp-content/themes/zagg/ and wp-content/uploads/
Alert on creation of .php files in upload directories where PHP execution should be disabled
Forward WordPress and web server logs to a centralized analytics platform and correlate AJAX activity with downstream process execution

How to Mitigate CVE-2025-4200

Immediate Actions Required

Update the Zagg theme to a version above 1.4.1 once the vendor publishes a patched release
Restrict access to wp-admin/admin-ajax.php through WAF policy until the theme is patched
Audit wp-content/uploads/ for unauthorized PHP files and remove any unknown content
Rotate WordPress administrator credentials and API keys if exploitation is suspected

Patch Information

Review the Wordfence Vulnerability Report for current patch status. At the time of NVD publication, the advisory identifies all versions up to and including 1.4.1 as vulnerable. Site operators should monitor the ThemeForest Product Overview for vendor updates.

Workarounds

Disable the Zagg theme and switch to an unaffected theme until a fix is released
Configure the web server to block PHP execution in wp-content/uploads/ and other writable directories
Apply a virtual patch through a WAF that drops requests containing path traversal characters in AJAX parameters targeting load_more_post, load_shop, and load_more_product

bash

# Apache: prevent PHP execution in uploads directory
<Directory /var/www/html/wp-content/uploads>
    <FilesMatch "\.(php|phtml|php5|php7|phar)$">
        Require all denied
    </FilesMatch>
</Directory>

# Nginx equivalent
location ~* /wp-content/uploads/.*\.(php|phtml|php5|php7|phar)$ {
    deny all;
    return 403;
}