CVE-2025-58940: Axiomthemes Basil Path Traversal Flaw

CVE-2025-58940 Overview

CVE-2025-58940 is a PHP Local File Inclusion (LFI) vulnerability in the axiomthemes Basil WordPress theme. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Attackers can manipulate file path parameters to load arbitrary local files through the theme's PHP execution context. The vulnerability affects all Basil theme versions up to and including 1.3.12. Successful exploitation can lead to disclosure of sensitive files, execution of attacker-controlled PHP code, and full site compromise. The issue was published to the National Vulnerability Database on December 18, 2025, and tracked through the Patchstack vulnerability database.

Critical Impact
Remote attackers can include arbitrary local files in the PHP execution context, leading to source code disclosure, configuration leakage, and potential remote code execution on the WordPress host.

Affected Products

axiomthemes Basil WordPress theme versions up to and including 1.3.12
WordPress installations using the Basil theme as the active theme
Sites where uploaded files can be referenced through the vulnerable include path

Discovery Timeline

2025-12-18 - CVE-2025-58940 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-58940

Vulnerability Analysis

The Basil theme accepts user-controlled input that is passed to a PHP include or require statement without sufficient validation. PHP interprets any file resolved through these statements as PHP code. An attacker who controls the filename argument can therefore force the application to parse and execute the contents of arbitrary local files. This class of flaw is tracked as [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program.

The vulnerability is reachable over the network without authentication, though the attack complexity is elevated because exploitation depends on specific request conditions or path constraints. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress site.

Root Cause

The Basil theme constructs a file path from request data and passes the resulting string to a PHP file inclusion function. The code does not enforce an allowlist of permitted filenames, does not canonicalize the path, and does not validate that the resolved file resides within an expected directory. Path traversal sequences such as ../ and direct references to writable upload directories therefore reach the PHP parser.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to a Basil theme endpoint that accepts a filename parameter. The attacker supplies a path that resolves to a sensitive file such as wp-config.php, an arbitrary PHP file on the filesystem, or a file the attacker previously uploaded through another vector. The Basil theme then includes the file, exposing its contents or executing embedded PHP. Full technical detail is documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-58940

Indicators of Compromise

HTTP requests to Basil theme PHP endpoints containing path traversal sequences such as ../ or URL-encoded equivalents like %2e%2e%2f
Requests referencing sensitive WordPress files including wp-config.php, .htaccess, or files under /etc/
Unexpected PHP errors in web server logs referencing include() or require() failures with attacker-controlled paths
New or modified PHP files in WordPress upload directories that are subsequently referenced by include requests

Detection Strategies

Inspect web server access logs for requests targeting Basil theme files with suspicious filename or path parameters
Deploy web application firewall rules that block path traversal patterns and absolute paths in query parameters destined for the theme
Monitor file integrity on wp-content/themes/basil/ and on the WordPress core configuration files

Monitoring Recommendations

Forward web server, PHP, and WordPress audit logs to a centralized analytics platform and alert on include-related error patterns
Track outbound connections originating from the PHP worker process, which can indicate post-exploitation behavior
Correlate authentication anomalies on the WordPress admin interface with prior file inclusion request patterns

How to Mitigate CVE-2025-58940

Immediate Actions Required

Identify all WordPress sites running the axiomthemes Basil theme version 1.3.12 or earlier
Disable or switch away from the Basil theme until a patched release is confirmed installed
Restrict access to WordPress admin and theme endpoints using IP allowlisting where feasible
Rotate WordPress secrets, database credentials, and API keys stored in wp-config.php if exploitation is suspected

Patch Information

No fixed version is listed in the NVD entry at the time of publication. The affected range covers Basil up to and including 1.3.12. Administrators should consult the Patchstack Vulnerability Report for the latest vendor remediation status and apply any vendor-supplied update as soon as it becomes available.

Workarounds

Block requests containing path traversal payloads at the web application firewall or reverse proxy layer
Configure PHP open_basedir to constrain file access to the WordPress document root and required directories
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent remote inclusion variants
Remove write permissions for the web server user on directories that contain PHP source files

bash

# Configuration example
# php.ini hardening for WordPress hosts running the Basil theme
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"