CVE-2025-58953: Joly Path Traversal Vulnerability

CVE-2025-58953 Overview

CVE-2025-58953 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Joly WordPress theme in versions 1.22.0 and earlier. The flaw allows remote attackers to include arbitrary local files through the theme's request handling logic without prior authentication. Successful exploitation can disclose sensitive files, expose configuration secrets, and in some hosting configurations lead to remote code execution through log poisoning or session file inclusion. The vulnerability is categorized under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Unauthenticated attackers can read arbitrary files from the WordPress server, exposing credentials in wp-config.php and potentially escalating to code execution.

Affected Products

Joly WordPress theme versions <= 1.22.0
WordPress sites running the vulnerable Joly theme
Hosting environments where PHP include/require resolves local paths without restriction

Discovery Timeline

2026-06-17 - CVE-2025-58953 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58953

Vulnerability Analysis

The Joly theme accepts attacker-controlled input that is passed to a PHP file inclusion function without sufficient validation or path normalization. Because the input flows into an include or require statement, an attacker can manipulate the filename to reference arbitrary local files. The issue does not require authentication, so any unauthenticated visitor able to reach the vulnerable endpoint can trigger it.

The attack is launched over the network against the WordPress front-end. The Patchstack advisory describes the issue as a Local File Inclusion affecting all Joly theme builds through 1.22.0. Exploitation does not require user interaction, but a degree of complexity is reflected in the scoring, suggesting specific request conditions or path handling steps must be met for reliable inclusion.

Root Cause

The root cause is improper control of a filename used in a PHP include statement, mapped to [CWE-98]. The theme constructs a file path from a user-supplied parameter and passes it to PHP's file inclusion API without enforcing an allowlist, sanitizing traversal sequences such as ../, or constraining the resolved path to a known theme directory. PHP then loads and executes the referenced file in the application context.

Attack Vector

An attacker sends a crafted HTTP request to a Joly theme endpoint that processes the vulnerable parameter. By supplying a path that traverses outside the theme directory, the attacker can target files such as wp-config.php, /etc/passwd, web server logs, or uploaded content. Including files containing attacker-controlled data — for example, poisoned access logs or session files — can convert the LFI into PHP code execution. Refer to the Patchstack Joly Theme Vulnerability advisory for vendor-published technical context.

Detection Methods for CVE-2025-58953

Indicators of Compromise

HTTP requests to Joly theme URLs containing path traversal sequences such as ../, ..%2f, or encoded null bytes (%00).
Requests whose query parameters reference sensitive files like wp-config.php, /etc/passwd, or PHP session files in /tmp or /var/lib/php.
Unexpected PHP include/require warnings in web server error logs referencing files outside wp-content/themes/joly/.
Outbound connections or process executions originating from the php-fpm or web server worker shortly after suspicious theme requests.

Detection Strategies

Inspect web access logs for repeated requests against Joly theme endpoints with parameters containing filesystem paths or traversal patterns.
Deploy Web Application Firewall (WAF) rules that block path traversal payloads and known WordPress LFI signatures targeting theme files.
Hunt for reads of wp-config.php by the web server user outside of normal WordPress bootstrap activity.
Correlate inclusion attempts with subsequent process spawns or file writes from the PHP worker for signs of post-exploitation.

Monitoring Recommendations

Enable verbose PHP error logging and forward logs to a centralized SIEM for parsing of failed to open stream and include() errors.
Alert on any 200-status response to a Joly theme request whose response size is anomalous relative to baseline.
Monitor file integrity of wp-config.php, theme files, and the wp-content/uploads directory for unauthorized changes.
Track unauthenticated request volume against theme endpoints and rate-limit sources exhibiting traversal behavior.

How to Mitigate CVE-2025-58953

Immediate Actions Required

Identify all WordPress sites running the Joly theme and confirm the installed version using wp theme list or the admin dashboard.
Upgrade Joly to a version newer than 1.22.0 once the vendor releases a fixed build, per the Patchstack advisory.
If no patched release is yet available, deactivate the Joly theme and switch to a maintained alternative.
Rotate any credentials, API keys, and database secrets stored in wp-config.php if exploitation is suspected.

Patch Information

At the time of publication, no fixed version is listed in the NVD record beyond noting that versions <= 1.22.0 are affected. Monitor the Patchstack database entry for Joly and the WordPress.org theme repository for an updated release. Apply the vendor patch as soon as it is available, and validate the fix by retesting the previously vulnerable endpoint with traversal payloads.

Workarounds

Block requests containing traversal sequences (../, ..%2f, %2e%2e/) at the WAF or reverse proxy layer.
Restrict PHP's open_basedir directive to the WordPress installation directory to limit file inclusion scope.
Disable the Joly theme entirely until a vendor patch is released and verified.
Apply virtual patching rules from a WordPress security plugin or managed WAF service that covers CVE-2025-58953.

bash

# Example php.ini hardening to constrain file inclusion paths
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off