CVE-2025-58944: Axiomthemes Manufactory Path Traversal

CVE-2025-58944 Overview

CVE-2025-58944 is a PHP Local File Inclusion (LFI) vulnerability in the axiomthemes Manufactory WordPress theme. The flaw exists in versions up to and including 1.4 and stems from improper control of filenames in PHP include/require statements [CWE-98]. An unauthenticated remote attacker can manipulate file path parameters to include arbitrary local files on the server. Successful exploitation can disclose sensitive files, expose credentials, and lead to code execution when combined with file upload primitives or log poisoning techniques.

Critical Impact
Unauthenticated attackers can include arbitrary PHP files on the server, potentially achieving information disclosure and remote code execution on affected WordPress sites.

Affected Products

axiomthemes Manufactory WordPress theme — all versions through 1.4
WordPress installations using the vulnerable theme
Any web server hosting the affected theme files

Discovery Timeline

2025-12-18 - CVE-2025-58944 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-58944

Vulnerability Analysis

The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The Manufactory theme accepts user-controlled input that is passed into a PHP include or require statement without adequate validation or sanitization. This allows an attacker to direct the server to load files outside the intended directory scope.

Because WordPress themes execute within the context of the web server user, any file readable by that account can be exposed. Attackers commonly target wp-config.php to extract database credentials and authentication keys. The attack requires no authentication and can be triggered remotely over the network, though successful exploitation depends on specific server-side conditions reflected in the elevated attack complexity.

Root Cause

The root cause is the absence of strict allow-listing on filename parameters consumed by PHP file inclusion functions. The theme likely accepts a path or template name through an HTTP request parameter and concatenates it into an include call without normalizing the path or restricting traversal sequences such as ../.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker crafts an HTTP request containing a manipulated filename parameter pointing to a sensitive local file or a traversal path. The PHP interpreter then loads and executes the referenced file in the current request context. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-58944

Indicators of Compromise

HTTP requests containing directory traversal sequences such as ../ or URL-encoded variants %2e%2e%2f targeting theme endpoints
Web server access logs showing requests to Manufactory theme PHP files with unusual query string parameters referencing system paths
Unexpected reads of wp-config.php, /etc/passwd, or PHP session files from the web server process
PHP error logs referencing failed include/require calls with attacker-controlled paths

Detection Strategies

Inspect web access logs for requests to /wp-content/themes/manufactory/ endpoints containing path traversal patterns or absolute file paths
Deploy Web Application Firewall (WAF) rules to flag LFI patterns in query parameters and POST bodies
Correlate file access telemetry from the web server user with HTTP request logs to identify out-of-policy reads

Monitoring Recommendations

Enable PHP open_basedir restrictions and monitor violation logs for inclusion attempts outside the WordPress root
Alert on outbound connections from the web server immediately following suspicious request patterns, which may indicate post-LFI code execution
Track theme and plugin inventory to ensure the Manufactory theme version is monitored across all WordPress instances

How to Mitigate CVE-2025-58944

Immediate Actions Required

Audit all WordPress sites for the presence of the axiomthemes Manufactory theme at version 1.4 or earlier
Disable or remove the Manufactory theme until a patched version is confirmed available from the vendor
Rotate wp-config.php secrets, database credentials, and any keys that may have been exposed if exploitation is suspected
Review web server access logs for the past several months for LFI exploitation indicators

Patch Information

At the time of publication, no fixed version has been confirmed in the available references. Consult the Patchstack WordPress Vulnerability advisory for the latest remediation guidance and switch to an actively maintained theme if no patch is released.

Workarounds

Deploy WAF rules blocking directory traversal sequences and absolute path references in HTTP parameters targeting the theme
Enforce PHP open_basedir to restrict file system access to the WordPress installation directory
Set allow_url_include and allow_url_fopen to Off in php.ini to prevent remote file inclusion escalation
Restrict file permissions on wp-config.php and other sensitive files to limit exposure if LFI is exploited

bash

# Configuration example: harden php.ini against file inclusion attacks
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"