CVE-2025-60049: Axiomthemes Soleil Path Traversal Flaw

CVE-2025-60049 Overview

CVE-2025-60049 is a PHP Local File Inclusion (LFI) vulnerability in the axiomthemes Soleil WordPress theme. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers can manipulate file path parameters to load arbitrary local files through the PHP interpreter. The vulnerability affects all Soleil theme versions up to and including 1.17. Successful exploitation can lead to disclosure of sensitive server-side files, execution of attacker-controlled PHP, and full site compromise. The issue was published to NVD on December 18, 2025.

Critical Impact
Remote, unauthenticated attackers can include arbitrary local PHP files, potentially leading to code execution and full WordPress site takeover.

Affected Products

axiomthemes Soleil WordPress theme versions through 1.17
WordPress sites running the Soleil theme without the vendor patch
Hosting environments where the theme processes attacker-controlled path parameters

Discovery Timeline

2025-12-18 - CVE-2025-60049 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-60049

Vulnerability Analysis

The Soleil theme passes user-controllable input into a PHP file-inclusion statement without proper validation or normalization. PHP file inclusion functions such as include, include_once, require, and require_once execute included files as PHP code. When attacker-controlled values reach these statements, an adversary can redirect execution to unintended files on the server.

This class of weakness is tracked as [CWE-98], Improper Control of Filename for Include/Require Statement. While the original CWE name references Remote File Inclusion, the Soleil instance is exploited as Local File Inclusion. Attackers reference files already present on the host, including log files, session files, uploaded content, or wrapper streams such as php://filter.

The impact is broad. Reading sensitive files such as wp-config.php exposes database credentials and secret keys. Including attacker-staged content in writable paths, log poisoning, or filter-chain techniques can escalate the issue from disclosure to code execution within the WordPress process.

Root Cause

The root cause is insufficient sanitization of a request parameter used to construct a path argument for a PHP inclusion function. The theme accepts the value, concatenates it into a file path, and passes the result to include or an equivalent function without enforcing an allowlist or restricting traversal sequences such as ../.

Attack Vector

The attack is network-based and does not require authentication or user interaction. An attacker sends a crafted HTTP request to a Soleil theme endpoint that consumes the vulnerable parameter. The PHP interpreter then loads and executes the referenced file in the context of the WordPress application user.

No public proof-of-concept code is currently linked in the references. For technical specifics, see the Patchstack Security Advisory.

Detection Methods for CVE-2025-60049

Indicators of Compromise

HTTP requests to Soleil theme paths containing traversal sequences such as ../, encoded variants like %2e%2e%2f, or PHP stream wrappers such as php://filter
Web server access logs showing parameter values referencing sensitive files such as wp-config.php, /etc/passwd, or /proc/self/environ
PHP error logs indicating failed include or require calls originating from theme files under wp-content/themes/soleil/
Unexpected outbound traffic or new administrative users following requests to Soleil endpoints

Detection Strategies

Inspect web access logs for query string parameters terminating in .php paths or referencing system files
Deploy WAF rules that flag PHP wrapper schemes and directory traversal patterns in requests to /wp-content/themes/soleil/
Hash and monitor theme files for unexpected modifications that may indicate post-exploitation persistence

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for correlation
Alert on read access to wp-config.php or other configuration files by the web server process
Track outbound network connections from the WordPress host that follow requests to Soleil theme URLs

How to Mitigate CVE-2025-60049

Immediate Actions Required

Identify all WordPress sites using the axiomthemes Soleil theme and confirm the installed version
Disable or remove the Soleil theme on sites running version 1.17 or earlier until a patched release is applied
Rotate WordPress secrets, database credentials, and administrative passwords if exploitation is suspected
Review the WordPress user table and wp-content/uploads/ for unauthorized accounts or PHP files

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Monitor the Patchstack Security Advisory and the axiomthemes vendor channels for an updated Soleil release that addresses CWE-98. Apply the fix as soon as it becomes available and re-scan the site post-patch.

Workarounds

Switch to an unaffected theme until a patched Soleil release is published
Deploy a web application firewall ruleset blocking directory traversal sequences and PHP stream wrappers in requests to theme endpoints
Restrict the PHP open_basedir directive to the WordPress document root to limit which files the interpreter can include
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent escalation to remote file inclusion

bash

# php.ini hardening to limit file inclusion exposure
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"