CVE-2025-58902: Lighthouse Path Traversal Vulnerability

CVE-2025-58902 Overview

CVE-2025-58902 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the WordPress Lighthouse theme in versions up to and including 1.2.12. The flaw is categorized under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. Remote attackers can reach the vulnerable code path without authentication over the network. Successful exploitation allows an attacker to include arbitrary local files, disclose sensitive server-side data, and potentially execute PHP under the web server context.

Critical Impact
Unauthenticated network-based attackers can include local files on the WordPress host, exposing credentials in wp-config.php and enabling further compromise of the site.

Affected Products

WordPress Lighthouse theme, versions <= 1.2.12
WordPress installations that ship or install the lighthouseschool theme
Multisite WordPress environments with the vulnerable theme active on any subsite

Discovery Timeline

2026-07-02 - CVE-2025-58902 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2025-58902

Vulnerability Analysis

The Lighthouse WordPress theme accepts user-controlled input that flows into a PHP include or require statement without proper validation or sanitization. This pattern maps directly to [CWE-98], where PHP inclusion functions consume attacker-influenced filenames. Because the endpoint is reachable without authentication, any anonymous visitor can trigger the flow.

An attacker can supply a path referencing files outside the intended directory. On success, PHP loads and interprets the target file, returning its contents or executing embedded PHP code. Sensitive targets include wp-config.php, session files, log files, and uploaded content that may contain injected payloads.

The attack complexity is elevated because exploitation typically requires knowledge of the underlying file layout, traversal sequences, or PHP wrappers such as php://filter. Once the correct parameter and path are identified, exploitation is reliable.

Root Cause

The root cause is missing validation on a request parameter that the theme concatenates into a PHP file inclusion call. The theme does not enforce an allowlist of permitted templates, does not normalize the path, and does not restrict traversal sequences such as ../. See the PatchStack Vulnerability Report for advisory-level details.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues a crafted HTTP GET or POST request to a Lighthouse theme endpoint with a filename parameter pointing to a sensitive local resource. The theme resolves the path and passes it to a PHP inclusion function, which loads the file from disk. Using PHP stream wrappers, an attacker can also base64-encode source files for exfiltration without triggering PHP execution errors.

No verified public exploit code is available at the time of publication. Refer to the PatchStack Vulnerability Report for advisory content.

Detection Methods for CVE-2025-58902

Indicators of Compromise

HTTP requests to Lighthouse theme paths under /wp-content/themes/lighthouseschool/ containing traversal sequences such as ../ or ..%2f.
Query strings referencing php://filter, php://input, /etc/passwd, or wp-config.php.
Web server access logs showing anonymous requests that return unusually large responses from theme endpoints.
New or modified PHP files in wp-content/uploads/ following suspicious inclusion attempts.

Detection Strategies

Inspect access logs for repeated requests to Lighthouse theme URLs with encoded path characters or wrapper prefixes.
Deploy Web Application Firewall (WAF) rules that block ../ sequences and PHP stream wrapper strings on parameters delivered to the theme.
Enable PHP open_basedir violation logging and alert on entries that reference the Lighthouse theme.

Monitoring Recommendations

Monitor outbound responses from WordPress that include <?php markers or database credentials, which indicate wp-config.php disclosure.
Track file integrity on wp-config.php, wp-content/themes/lighthouseschool/, and wp-content/uploads/.
Correlate authentication anomalies with prior LFI attempts, since credential theft commonly follows file disclosure.

How to Mitigate CVE-2025-58902

Immediate Actions Required

Deactivate the Lighthouse theme on any WordPress site running version <= 1.2.12 until a patched release is confirmed.
Rotate all secrets stored in wp-config.php, including database credentials and authentication keys, if the theme was exposed to the internet.
Block traffic to Lighthouse theme paths at the WAF or reverse proxy until remediation is complete.
Review web server and PHP logs for evidence of prior exploitation attempts.

Patch Information

No fixed version is listed in the enriched CVE data at the time of publication. Site operators should consult the PatchStack Vulnerability Report for vendor updates and apply the next Lighthouse theme release that addresses CVE-2025-58902.

Workarounds

Switch to an alternative WordPress theme until a patched Lighthouse release is available.
Restrict PHP file access using open_basedir in php.ini to prevent inclusion of files outside the WordPress root.
Add WAF signatures that reject requests containing ../, php://, file://, and data:// in query parameters.
Enforce least-privilege file permissions so the web server user cannot read wp-config.php beyond what is required.

bash

# Configuration example: restrict PHP file access via open_basedir
# Add to php.ini or per-vhost PHP-FPM pool configuration
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
allow_url_include = Off
allow_url_fopen = Off