CVE-2025-58937 Overview
CVE-2025-58937 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes Tacticool WordPress theme. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. Attackers can manipulate file path inputs to load arbitrary local files through the theme's PHP execution context. The vulnerability affects all Tacticool theme versions up to and including 1.0.13. Successful exploitation can expose sensitive configuration files, source code, and credentials, and may lead to remote code execution when combined with file upload primitives. The issue is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.
Critical Impact
Unauthenticated attackers can include arbitrary local PHP files, potentially leading to information disclosure, credential theft, and remote code execution on affected WordPress sites.
Affected Products
- Axiomthemes Tacticool WordPress theme versions through 1.0.13
- WordPress installations running the Tacticool theme
- Sites with the vulnerable theme active or accessible via direct file requests
Discovery Timeline
- 2025-12-18 - CVE-2025-58937 published to NVD
- 2026-04-27 - Last updated in NVD database
Technical Details for CVE-2025-58937
Vulnerability Analysis
The Tacticool theme accepts user-controlled input that is passed directly into a PHP include, require, include_once, or require_once statement. Without proper sanitization or allow-listing, this input controls which file PHP loads and executes. An attacker can supply path traversal sequences such as ../../ to read or execute files outside the intended directory. Targets typically include wp-config.php, /etc/passwd, and PHP session files. When session files or log files contain attacker-controlled content, the LFI can escalate to remote code execution. The network attack vector and lack of authentication requirement broaden the exposure surface across publicly accessible WordPress installations.
Root Cause
The root cause is the unsafe use of untrusted input in a file inclusion sink. The theme fails to validate, sanitize, or restrict the filename parameter against a fixed allow-list of expected templates. PHP's file inclusion functions resolve relative paths and execute any included file as PHP, making this class of bug particularly dangerous when input flows directly to the sink without canonicalization checks.
Attack Vector
Exploitation requires no authentication or user interaction. An attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the Tacticool theme, specifying a path traversal payload in the vulnerable parameter. The high attack complexity reflects conditions such as required knowledge of file paths or specific server configuration. Once a sensitive file is included, its contents may be rendered, executed, or echoed in the response. Refer to the Patchstack Vulnerability Report for technical details.
No verified public proof-of-concept code is available at this time. The vulnerability mechanism follows standard PHP LFI patterns where a request parameter flows unchecked into an include statement, allowing path traversal payloads to reference arbitrary files on the filesystem.
Detection Methods for CVE-2025-58937
Indicators of Compromise
- HTTP requests containing path traversal sequences such as ../, ..%2f, or encoded null bytes targeting Tacticool theme files
- Web server access logs showing requests referencing wp-config.php, /etc/passwd, or PHP session files via theme parameters
- Unexpected PHP errors or warnings in logs referencing include() or require() calls with unusual paths
Detection Strategies
- Inspect WordPress access logs for requests to Tacticool theme PHP files containing file path parameters
- Deploy web application firewall rules that block path traversal sequences against theme endpoints
- Audit installed WordPress themes and flag any Tacticool installation at version 1.0.13 or earlier
Monitoring Recommendations
- Monitor for outbound connections or new PHP files written to wp-content/uploads/ following suspicious theme requests
- Alert on read access to wp-config.php from the web server process outside of normal WordPress request flows
- Track WordPress file integrity for unexpected modifications to theme directories
How to Mitigate CVE-2025-58937
Immediate Actions Required
- Identify all WordPress sites running the Axiomthemes Tacticool theme and confirm installed versions
- Disable or remove the Tacticool theme on any site running version 1.0.13 or earlier until a patched release is available
- Rotate WordPress secret keys and database credentials if exploitation is suspected, particularly if wp-config.php may have been disclosed
Patch Information
No fixed version has been published in the available vendor advisory at the time of writing. Monitor the Patchstack Vulnerability Report and the vendor's theme distribution channel for an updated release beyond 1.0.13.
Workarounds
- Deploy WAF rules blocking path traversal payloads such as ../, ..%2f, and ..%5c in query parameters targeting theme files
- Restrict PHP open_basedir to limit which directories PHP can read or include
- Disable allow_url_include in php.ini to prevent escalation to remote file inclusion
- Switch to an alternative WordPress theme until a patched version is released
# php.ini hardening to limit file inclusion scope
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
