CVE-2025-52812 Overview
CVE-2025-52812 is a Local File Inclusion (LFI) vulnerability affecting the ApusWP Domnoo WordPress theme through version 1.49. The flaw stems from improper control of filenames used in PHP include/require statements, classified under [CWE-98]. Unauthenticated network attackers can manipulate file path parameters to include arbitrary local PHP files on the underlying server. Successful exploitation leads to source code disclosure, sensitive configuration exposure, and potential remote code execution when combined with file upload primitives or log poisoning techniques.
Critical Impact
Unauthenticated attackers can include arbitrary local PHP files, exposing sensitive data such as wp-config.php credentials and enabling code execution chains.
Affected Products
- ApusWP Domnoo WordPress theme versions n/a through 1.49
- WordPress sites running the Domnoo theme
- Hosting environments where the vulnerable theme is installed and active
Discovery Timeline
- 2025-06-27 - CVE-2025-52812 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-52812
Vulnerability Analysis
The vulnerability resides in how the Domnoo theme handles user-controlled input passed to PHP file inclusion functions. PHP provides include, include_once, require, and require_once statements that load and execute the contents of a referenced file. When the filename argument incorporates untrusted input without strict validation, attackers can redirect inclusion to unintended files on the local filesystem.
In the Domnoo theme, request parameters reach an inclusion sink without sufficient sanitization or allow-list enforcement. Attackers can supply traversal sequences such as ../ or absolute paths to load PHP files outside the intended directory. Once included, the target file is parsed and executed in the WordPress request context, exposing its contents and any side effects of execution.
Root Cause
The root cause is improper control of the filename for an include/require statement [CWE-98]. The theme treats request-supplied path data as trusted, omitting normalization, base directory pinning, and allow-list verification before passing it to PHP's inclusion API.
Attack Vector
The attack is delivered over the network against the WordPress front end. No authentication or user interaction is required. The attacker issues an HTTP request that targets the vulnerable theme endpoint and supplies a crafted path parameter pointing at sensitive local files such as wp-config.php, log files, or session files. The high attack complexity rating reflects conditions required to reach the vulnerable code path reliably.
For technical specifics, refer to the Patchstack WordPress Vulnerability Report.
Detection Methods for CVE-2025-52812
Indicators of Compromise
- HTTP requests to Domnoo theme endpoints containing path traversal sequences such as ../, ..%2f, or ....//
- Requests with parameters referencing sensitive files including wp-config.php, /etc/passwd, or /proc/self/environ
- Anomalous PHP errors in web server logs referencing include() or require() failures with attacker-supplied paths
- Outbound connections from the web server immediately following suspicious inclusion requests
Detection Strategies
- Inspect web server access logs for requests targeting /wp-content/themes/domnoo/ paths with suspicious query parameters
- Deploy WAF rules that flag path traversal patterns and absolute path arguments in HTTP parameters
- Monitor PHP error logs for inclusion failures that reveal attacker probing behavior
- Correlate file inclusion attempts with subsequent webshell creation or unusual process spawns under the web server user
Monitoring Recommendations
- Enable verbose access logging on WordPress hosts running the Domnoo theme
- Forward web and PHP logs to a centralized SIEM for pattern matching against LFI signatures
- Track file integrity for wp-config.php, theme files, and uploads directories to detect post-exploitation tampering
How to Mitigate CVE-2025-52812
Immediate Actions Required
- Identify all WordPress instances running the ApusWP Domnoo theme at version 1.49 or earlier
- Deactivate and replace the Domnoo theme until a patched release is verified by the vendor
- Rotate any secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation is suspected
- Audit wp-content/uploads/ and theme directories for unauthorized PHP files
Patch Information
No vendor patch is referenced in the available CVE data beyond the advisory. Consult the Patchstack WordPress Vulnerability Report for the latest fixed version guidance and apply the upgrade as soon as it becomes available.
Workarounds
- Place WAF rules in front of the site to block path traversal sequences and inclusion of sensitive system files
- Configure PHP open_basedir to restrict file access to the WordPress installation directory
- Disable the Domnoo theme and switch to a maintained alternative until remediation is confirmed
- Restrict access to the WordPress site by IP allow-list during active triage where feasible
# Example PHP open_basedir hardening in php.ini
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
