CVE-2025-58936: Axiomthemes Catamaran Path Traversal Flaw

CVE-2025-58936 Overview

CVE-2025-58936 is a Local File Inclusion (LFI) vulnerability in the axiomthemes Catamaran WordPress theme. The flaw stems from improper control of filenames passed to PHP include or require statements, classified under [CWE-98]. Attackers can leverage the issue to load arbitrary local PHP files within the WordPress server context. The vulnerability affects all Catamaran versions up to and including 1.15. Successful exploitation can expose sensitive configuration data, application source code, and in some configurations enable code execution through log poisoning or file upload chains.

Critical Impact
Unauthenticated network attackers can include arbitrary local files via the Catamaran theme, leading to information disclosure and potential remote code execution on affected WordPress sites.

Affected Products

axiomthemes Catamaran WordPress theme versions through 1.15
WordPress sites running the Catamaran theme as the active or installed theme
Multisite WordPress installations where Catamaran is network-enabled

Discovery Timeline

2025-12-18 - CVE-2025-58936 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-58936

Vulnerability Analysis

The Catamaran theme passes user-controllable input to a PHP include or require statement without sufficient validation or path normalization. This permits an attacker to manipulate the filename argument and direct the interpreter to load files outside the intended template directory. Because PHP include statements execute the contents of any included file as PHP, the impact extends beyond simple file disclosure.

The issue is reachable over the network without authentication, though successful exploitation requires specific conditions to be met, contributing to the high attack complexity rating. The EPSS probability is 0.222% as of 2026-05-04.

Root Cause

The root cause is improper neutralization of a filename used in a dynamic file inclusion. The theme accepts a parameter that is concatenated into an include path, and the code does not enforce an allow-list of permitted templates, strip directory traversal sequences such as ../, or restrict resolution to the theme directory. This pattern matches [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program.

Attack Vector

An attacker crafts an HTTP request to a vulnerable Catamaran endpoint, supplying a manipulated filename parameter that resolves to a sensitive local path such as wp-config.php, server logs, or an uploaded file. The PHP interpreter then includes and executes the targeted file. Where attackers can write attacker-controlled content to a predictable local path, for example through file uploads or by poisoning access logs, the LFI primitive can be escalated to remote code execution.

Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-58936

Indicators of Compromise

HTTP requests to Catamaran theme paths under wp-content/themes/catamaran/ containing directory traversal sequences such as ../ or URL-encoded equivalents like %2e%2e%2f
Requests with parameters resolving to sensitive files such as wp-config.php, /etc/passwd, or PHP session and log files
PHP error log entries referencing include() or require() failures with attacker-controlled paths

Detection Strategies

Inspect web server access logs for anomalous query parameters targeting Catamaran theme files with path traversal patterns
Deploy WordPress security plugins or web application firewall rules that flag LFI signatures targeting theme parameters
Correlate file inclusion attempts with subsequent requests to uploaded files or log files that could host attacker payloads

Monitoring Recommendations

Enable PHP log_errors and forward errors to a centralized SIEM for correlation against web access patterns
Monitor changes to WordPress core files, wp-config.php, and theme directories for unexpected reads or writes
Track outbound connections from the web server, since LFI chained with RCE typically results in reverse shells or callbacks

How to Mitigate CVE-2025-58936

Immediate Actions Required

Identify all WordPress installations running axiomthemes Catamaran at version 1.15 or earlier
Disable or remove the Catamaran theme until a vendor patch is available and applied
Restrict access to WordPress administrative endpoints and theme directories at the network or WAF layer
Review web server logs for prior exploitation attempts referencing Catamaran theme paths

Patch Information

No fixed version is identified in the available advisory data. The vulnerability affects Catamaran through version 1.15. Monitor the Patchstack WordPress Vulnerability Report and the axiomthemes vendor channel for an updated release, and apply it immediately upon publication.

Workarounds

Switch the active WordPress theme to a maintained alternative until a fix is released
Deploy WAF rules that block requests containing path traversal sequences targeting theme parameters
Set PHP open_basedir to restrict file access to the WordPress installation directory, limiting LFI reach
Disable PHP allow_url_include and confirm allow_url_fopen restrictions to prevent remote inclusion escalation

bash

# Example php.ini hardening to limit LFI impact
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off