CVE-2025-49879: Litho WordPress Theme Path Traversal Flaw

CVE-2025-49879 Overview

CVE-2025-49879 is a path traversal vulnerability affecting the themezaa Litho WordPress theme. The flaw exists in versions through 3.0 and allows unauthenticated attackers to traverse outside the intended directory. According to the Patchstack advisory, the issue results in arbitrary file deletion on the affected WordPress installation. Successful exploitation can remove critical files such as wp-config.php, which can render the site inoperable or enable follow-on compromise. The vulnerability is classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact

Unauthenticated remote attackers can delete arbitrary files on WordPress sites running Litho theme versions through 3.0, leading to site disruption and potential further compromise.

Affected Products

• themezaa Litho WordPress theme versions through 3.0
• WordPress installations using the vulnerable Litho theme
• Sites that have not applied the vendor patch beyond version 3.0

Discovery Timeline

• 2025-06-17 - CVE-2025-49879 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-49879

Vulnerability Analysis

The vulnerability stems from improper sanitization of user-supplied file path parameters within the Litho theme. An attacker can craft requests containing directory traversal sequences such as ../ to escape the intended directory scope. The theme then operates on the manipulated path, resulting in arbitrary file deletion outside the permitted location.

The attack requires no authentication and no user interaction. The network-based attack vector and scope change indicate that exploitation can impact resources beyond the vulnerable component. The Exploit Prediction Scoring System (EPSS) data indicates moderate exploitation likelihood relative to the broader CVE population.

Root Cause

The root cause is insufficient validation and sanitization of file path inputs passed to file system operations within the Litho theme code. The theme accepts attacker-controlled path values and uses them in deletion routines without canonicalizing the path or restricting it to an allow-listed directory. This [CWE-22] weakness permits traversal outside the intended directory boundary.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable Litho theme endpoint. The request includes path traversal sequences targeting sensitive files. When processed, the theme deletes the targeted file. Deleting wp-config.php triggers WordPress to enter installation mode, which an attacker can leverage to take over the site by pointing it to a controlled database.

Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-49879

Indicators of Compromise

• HTTP requests containing ../ or URL-encoded variants (%2e%2e%2f) targeting Litho theme endpoints under /wp-content/themes/litho/
• Unexpected deletion of WordPress core files such as wp-config.php, .htaccess, or theme and plugin files
• WordPress site redirecting to the installation wizard without administrator action
• Web server logs showing anonymous POST or GET requests to Litho theme PHP files with file path parameters

Detection Strategies

• Inspect web server access logs for requests to Litho theme files containing traversal sequences or suspicious file, path, or filename parameters
• Deploy file integrity monitoring on the WordPress root and wp-content directories to alert on unauthorized deletions
• Configure web application firewall (WAF) rules to identify directory traversal patterns directed at theme paths

Monitoring Recommendations

• Alert on any modification or deletion event affecting wp-config.php or other root-level WordPress files
• Monitor for sudden HTTP 500 errors or installation wizard responses on production WordPress sites
• Track outbound connections from the web server to unfamiliar database hosts, which can indicate post-deletion takeover attempts

How to Mitigate CVE-2025-49879

Immediate Actions Required

• Update the Litho theme to a version released after 3.0 that addresses the path traversal flaw
• Audit the WordPress filesystem for missing or recently deleted core, theme, and plugin files
• Restore any deleted files from a known-good backup and verify site integrity before returning to production
• Restrict access to theme administrative endpoints behind authentication where feasible

Patch Information

The Patchstack advisory tracks remediation status for this vulnerability. Site administrators should apply the vendor-supplied update for the Litho theme as soon as it is available. Consult the Patchstack Vulnerability Report for the latest fixed version details.

Workarounds

• Deploy a WAF rule that blocks requests containing ../, ..\\, or encoded traversal sequences targeting /wp-content/themes/litho/
• Temporarily disable the Litho theme and switch to a default WordPress theme until a patched version is installed
• Restrict file permissions on wp-config.php and other sensitive files so the web server user cannot delete them
• Place the WordPress installation behind authentication or IP allow-listing for administrative paths

# Example ModSecurity rule to block traversal attempts against the Litho theme
SecRule REQUEST_URI "@contains /wp-content/themes/litho/" \
    "chain,deny,status:403,id:1004987901,msg:'Litho path traversal attempt (CVE-2025-49879)'"
    SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:none,t:lowercase,t:urlDecodeUni"