CVE-2025-58945: Axiomthemes Ecogrow Path Traversal Flaw

CVE-2025-58945 Overview

CVE-2025-58945 is a Local File Inclusion (LFI) vulnerability in the axiomthemes EcoGrow WordPress theme. The flaw affects all versions up to and including 1.7. The theme fails to properly control filenames used in PHP include or require statements, classified as [CWE-98]. Attackers can leverage this weakness to load arbitrary local PHP files through the affected theme. Successful exploitation can lead to disclosure of sensitive server files and execution of attacker-controlled code already present on the host.

Critical Impact
Remote attackers can include arbitrary local files on the server, leading to source code disclosure, sensitive file exposure, and potential code execution within the WordPress site.

Affected Products

axiomthemes EcoGrow WordPress theme (all versions through 1.7)
WordPress sites running the vulnerable EcoGrow theme
Hosting environments where the EcoGrow theme is active

Discovery Timeline

2025-12-18 - CVE-2025-58945 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-58945

Vulnerability Analysis

The vulnerability falls under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. The EcoGrow theme passes user-controllable input into a PHP include or require call without sufficient validation or allowlisting. An unauthenticated attacker can manipulate the parameter to point at local files outside the intended template directory. While the original CWE name references Remote File Inclusion, the Patchstack advisory confirms the practical impact is Local File Inclusion.

Root Cause

The root cause is missing input validation on a filename or path parameter consumed by a PHP file inclusion function within the theme. The theme does not constrain the value to a fixed set of allowed templates, nor does it strip directory traversal sequences. As a result, attacker-supplied input flows directly into a server-side include operation.

Attack Vector

The attack is network-based and requires no authentication or user interaction, though attack complexity is high. An attacker crafts a HTTP request targeting the vulnerable theme endpoint and supplies a path referencing a local file. The PHP interpreter then loads and executes that file in the context of the WordPress process. Attackers can read configuration files such as wp-config.php or execute uploaded PHP payloads previously written to disk through other channels.

No public proof-of-concept or exploit code is available at the time of publication. Technical details are documented in the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2025-58945

Indicators of Compromise

HTTP requests to EcoGrow theme files containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
Access log entries referencing sensitive paths like wp-config.php, /etc/passwd, or PHP session files via theme parameters
Unexpected PHP execution originating from theme directories under wp-content/themes/ecogrow/
Outbound connections or file writes from the web server process following suspicious theme requests

Detection Strategies

Inspect web server access logs for query parameters that include filesystem paths or null byte sequences targeting the EcoGrow theme
Deploy web application firewall (WAF) rules that block path traversal patterns against WordPress theme endpoints
Monitor PHP error logs for include or require warnings referencing unexpected file paths
Correlate file inclusion attempts with subsequent process execution or file modification events on the server

Monitoring Recommendations

Alert on read access to wp-config.php and other WordPress secrets from the web server user outside expected workflows
Track integrity of the wp-content/themes/ecogrow/ directory to identify tampering or webshell placement
Aggregate WordPress, web server, and host telemetry into a centralized data lake for cross-source correlation

How to Mitigate CVE-2025-58945

Immediate Actions Required

Identify all WordPress installations running the axiomthemes EcoGrow theme version 1.7 or earlier
Deactivate the EcoGrow theme on affected sites until a patched version is confirmed available
Restrict access to WordPress admin and theme endpoints using IP allowlists or authentication gateways
Review web server logs for prior exploitation attempts referencing theme parameters with path traversal payloads

Patch Information

No fixed version has been published at the time of NVD release. The vendor advisory tracked by Patchstack lists EcoGrow versions through 1.7 as affected. Site operators should monitor the Patchstack advisory and the axiomthemes vendor channel for an updated release.

Workarounds

Replace the EcoGrow theme with a maintained alternative until a patched version is released
Configure the WAF or reverse proxy to block requests containing ../, ..%2f, or absolute paths in theme query parameters
Apply PHP open_basedir restrictions to limit which directories the WordPress process can read
Set strict filesystem permissions so the web server user cannot read sensitive files such as wp-config.php backups outside the document root

bash

# Example PHP open_basedir restriction in php.ini or vhost config
php_admin_value open_basedir "/var/www/html/:/tmp/"

# Example nginx rule to block path traversal in theme requests
location ~* /wp-content/themes/ecogrow/ {
    if ($args ~* "\.\./|\.\.%2f|/etc/passwd|wp-config") {
        return 403;
    }
}