CVE-2025-58705: Axiomthemes Crafti File Inclusion Flaw

CVE-2025-58705 Overview

CVE-2025-58705 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes Crafti WordPress theme. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers exploiting this issue can include arbitrary local files through the PHP runtime, leading to source code disclosure, sensitive configuration exposure, or code execution when log files or uploaded content can be referenced.

The vulnerability affects Crafti theme versions from an unspecified earlier release through version 1.12. The issue is network-exploitable without authentication or user interaction, though attack complexity is rated high.

Critical Impact
Unauthenticated remote attackers can include local files on the WordPress server, potentially leading to disclosure of credentials in wp-config.php and downstream code execution.

Affected Products

Axiomthemes Crafti WordPress theme versions up to and including 1.12
WordPress sites running the vulnerable Crafti theme
Hosting environments where PHP allow_url_include or writable log paths amplify impact

Discovery Timeline

2026-06-02 - CVE-2025-58705 published to the National Vulnerability Database
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2025-58705

Vulnerability Analysis

The Crafti theme passes attacker-influenced input into PHP file inclusion functions without sufficient validation. When user-supplied data reaches include, include_once, require, or require_once, PHP resolves the path and executes the referenced file as PHP code. Because the inclusion target is not constrained to a safe allowlist, an attacker can traverse the filesystem and reference arbitrary files readable by the web server user.

Local File Inclusion in WordPress themes typically exposes wp-config.php, which contains database credentials and authentication keys. Attackers can also chain LFI with log poisoning, session file inclusion, or phar:// stream wrappers to escalate from file read to remote code execution.

Root Cause

The root cause is missing or insufficient sanitization of a filename parameter consumed by a PHP inclusion statement. CWE-98 covers exactly this pattern: dynamic inclusion where attacker-controlled input determines the path. The theme accepts a request parameter, concatenates it into an inclusion call, and does not enforce a fixed directory, allowlist, or extension constraint.

Attack Vector

The vulnerability is network-reachable and requires no privileges or user interaction. An attacker issues a crafted HTTP request to a vulnerable theme endpoint, supplying a path traversal sequence or absolute path as the inclusion parameter. The PHP interpreter then executes or reveals the contents of the targeted file. Refer to the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2025-58705

Indicators of Compromise

HTTP requests to Crafti theme endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd
Web server access logs showing parameters referencing wp-config.php, /proc/self/environ, or PHP wrapper schemes like php://filter and phar://
Unexpected PHP error entries referencing failed include or require calls from the Crafti theme directory
Outbound connections from the web server to attacker infrastructure shortly after suspicious inclusion requests

Detection Strategies

Inspect web access logs for query strings containing encoded traversal patterns directed at theme PHP files
Monitor PHP error logs for failed to open stream or No such file or directory warnings originating in the Crafti theme path
Deploy a web application firewall rule that blocks inclusion-style parameters referencing sensitive paths or stream wrappers

Monitoring Recommendations

Alert on any read access to wp-config.php by the web server process outside of WordPress initialization
Track new outbound network connections initiated by php-fpm or the web server to uncommon destinations
Baseline normal request patterns to the Crafti theme and flag deviations involving unusual parameters

How to Mitigate CVE-2025-58705

Immediate Actions Required

Identify all WordPress installations using the Axiomthemes Crafti theme and confirm installed version against 1.12
Upgrade the Crafti theme to a vendor-supplied version that addresses CVE-2025-58705 once available, per the Patchstack advisory
Rotate WordPress database credentials, authentication keys, and salts if exposure is suspected
Review web server logs for prior exploitation attempts referencing theme inclusion parameters

Patch Information

No fixed version is listed in the NVD record at publication. Consult the Patchstack advisory and the Axiomthemes vendor channels for the patched Crafti release. Until a vendor patch is applied, virtual patching via a web application firewall is the primary control.

Workarounds

Disable or remove the Crafti theme until a patched version is installed
Configure PHP with allow_url_include=Off and restrict open_basedir to the WordPress document root to limit inclusion scope
Deploy WAF rules that block requests containing ../, php://, phar://, or references to wp-config.php in query parameters
Restrict filesystem permissions so the web server user cannot read sensitive files outside the WordPress directory

bash

# php.ini hardening to limit Local File Inclusion impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "phpinfo,system,exec,shell_exec,passthru,proc_open,popen"