CVE-2025-54709: Sala WordPress Plugin RCE Vulnerability

CVE-2025-54709 Overview

CVE-2025-54709 is a PHP File Inclusion vulnerability affecting the Uxper Sala WordPress theme through version 1.1.6. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Unauthenticated attackers can manipulate file path parameters to load arbitrary local files or, in misconfigured environments, remote PHP resources. Successful exploitation can lead to sensitive file disclosure, configuration leakage, and arbitrary code execution within the WordPress process context. The issue is tracked under the Patchstack vulnerability database and impacts the confidentiality, integrity, and availability of affected WordPress sites.

Critical Impact
Unauthenticated attackers can include arbitrary files through the Sala theme, enabling potential remote code execution on vulnerable WordPress installations.

Affected Products

Uxper Sala WordPress theme versions up to and including 1.1.6
WordPress sites using the Sala theme without the vendor patch
Hosting environments where allow_url_include is enabled, broadening exploitation to remote file inclusion

Discovery Timeline

2025-09-09 - CVE-2025-54709 published to the National Vulnerability Database
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-54709

Vulnerability Analysis

The Sala theme accepts user-controlled input that flows into a PHP include or require statement without adequate validation or allow-listing. Because the filename is not constrained to a safe directory or a predefined set of templates, an attacker can supply traversal sequences or alternate paths to load arbitrary files from the server. When allow_url_include is enabled in the PHP configuration, the same sink permits remote file inclusion, allowing attacker-hosted PHP to execute under the web server identity.

The attack requires no authentication and no user interaction, though the CVSS vector indicates higher attack complexity, suggesting specific conditions must be met for reliable exploitation. Impact extends to leaking secrets from files such as wp-config.php, executing PHP gadgets via log poisoning, or chaining with file upload primitives to achieve full remote code execution.

Root Cause

The root cause is the absence of strict input validation and path normalization before user-supplied data reaches a dynamic file inclusion sink. The theme trusts request parameters that designate template or partial filenames and concatenates them into an include path without restricting the resolved location to the theme directory.

Attack Vector

Exploitation occurs over the network against the WordPress front end. An attacker crafts an HTTP request that supplies a malicious value for the vulnerable parameter, pointing to a sensitive local file or an attacker-controlled remote resource. See the Patchstack WordPress Vulnerability Report for technical specifics on the affected parameter and request pattern.

Detection Methods for CVE-2025-54709

Indicators of Compromise

HTTP requests to Sala theme endpoints containing path traversal sequences such as ../, ..%2f, or null byte variants in template-related parameters
Web server access logs showing references to wp-config.php, /etc/passwd, or php://filter wrappers in query strings
Unexpected outbound network connections from the PHP-FPM or web server process to attacker-controlled hosts following inbound requests to the theme

Detection Strategies

Inspect WordPress access logs for requests targeting the Sala theme directory with suspicious file path parameters
Deploy web application firewall rules that detect Local File Inclusion patterns, including encoded traversal sequences and PHP stream wrappers
Monitor PHP error logs for include() or require() warnings referencing unexpected file paths originating from the theme

Monitoring Recommendations

Alert on read access to sensitive files such as wp-config.php from the web server process outside normal application flows
Track file integrity on theme directories to detect attacker-placed PHP payloads used in chained attacks
Correlate inbound HTTP requests to the Sala theme with subsequent outbound traffic or new process executions on the host

How to Mitigate CVE-2025-54709

Immediate Actions Required

Update the Uxper Sala theme to a version newer than 1.1.6 once the vendor releases a patched build
Disable or remove the Sala theme if a fixed version is not yet available and switch to an alternate theme
Set allow_url_include = Off in php.ini to eliminate the remote file inclusion path
Restrict web server file system permissions so the PHP process cannot read sensitive configuration files outside the WordPress root

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the latest vendor patch status and fixed version information. Apply the update through the WordPress admin dashboard or via direct theme replacement.

Workarounds

Deploy a web application firewall with rules blocking path traversal sequences and PHP stream wrappers in query parameters
Use open_basedir PHP restrictions to confine file access to the WordPress installation directory
Place the WordPress instance behind authentication for non-public sites until the patch is applied

bash

# Example php.ini hardening to limit file inclusion exposure
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"