CVE-2025-60055: Fabrica Theme File Inclusion Vulnerability

CVE-2025-60055 Overview

CVE-2025-60055 is a PHP Local File Inclusion (LFI) vulnerability affecting the AncoraThemes Fabrica WordPress theme. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server filesystem. This flaw can lead to unauthorized access to sensitive configuration files, potential disclosure of credentials, and in some scenarios, remote code execution if combined with other attack techniques.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely to read sensitive files from the WordPress server, potentially exposing database credentials, API keys, and other confidential information stored on the filesystem.

Affected Products

• AncoraThemes Fabrica WordPress Theme versions up to and including 1.8.1

Discovery Timeline

• 2025-12-18 - CVE-2025-60055 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-60055

Vulnerability Analysis

This vulnerability falls under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Fabrica theme fails to properly validate or sanitize user-controlled input before passing it to PHP's include() or require() functions. When an attacker manipulates the filename parameter, they can traverse directory structures and include files outside the intended application scope.

The network-based attack vector means exploitation requires no local access to the target system. Additionally, no authentication or user interaction is required to exploit this vulnerability, making it particularly dangerous for publicly accessible WordPress installations. Successful exploitation primarily compromises confidentiality by exposing sensitive file contents, with limited impact on system availability.

Root Cause

The root cause is insufficient input validation on user-supplied file path parameters within the Fabrica theme's PHP code. The application fails to implement proper allowlisting of permitted files, does not adequately sanitize directory traversal sequences (such as ../), and lacks proper canonicalization of file paths before inclusion. This allows attackers to manipulate the include path to reference arbitrary files on the server filesystem.

Attack Vector

The vulnerability can be exploited remotely over the network without authentication. An attacker crafts malicious HTTP requests containing directory traversal sequences to navigate outside the web application's intended directory structure. Common targets include /etc/passwd for system reconnaissance, wp-config.php for database credentials, and other sensitive configuration files.

The attack flow typically involves:

1. Identifying a vulnerable endpoint in the Fabrica theme that accepts filename parameters
2. Injecting path traversal sequences to escape the intended directory
3. Specifying the target file path to include and read its contents
4. The server processes the malicious request and returns the file contents in the response

For technical details on the specific vulnerable code paths, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-60055

Indicators of Compromise

• HTTP requests containing directory traversal patterns such as ../, ..%2F, or ....// targeting Fabrica theme endpoints
• Unusual access patterns to WordPress theme files or directories
• Web server logs showing requests attempting to access system files like /etc/passwd or wp-config.php
• Unexpected file read operations originating from the web server process

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
• Implement file integrity monitoring on WordPress core files and sensitive configuration files
• Enable detailed web server access logging and analyze for suspicious request patterns
• Use SentinelOne's Singularity platform to monitor for anomalous file access behavior from web server processes

Monitoring Recommendations

• Configure alerting for any access attempts to sensitive system files from web application contexts
• Monitor WordPress error logs for include/require failures that may indicate exploitation attempts
• Track failed file access attempts that could signal reconnaissance activity
• Implement real-time log analysis for path traversal attack signatures

How to Mitigate CVE-2025-60055

Immediate Actions Required

• Update the Fabrica WordPress theme to the latest patched version immediately
• If no patch is available, deactivate the Fabrica theme until a security update is released
• Review web server logs for evidence of exploitation attempts
• Audit file permissions to restrict web server read access to only necessary files
• Implement WAF rules to block path traversal patterns targeting WordPress themes

Patch Information

Site administrators should check the official AncoraThemes marketplace or WordPress theme repository for an updated version of Fabrica that addresses this vulnerability. The Patchstack Vulnerability Report provides additional details on the affected versions and remediation guidance.

Workarounds

• Implement strict WAF rules to filter requests containing directory traversal sequences
• Restrict web server process permissions using open_basedir PHP directive to limit accessible directories
• Apply file system permissions to prevent the web server user from reading sensitive files outside the web root
• Consider using a WordPress security plugin with virtual patching capabilities until an official fix is available

# PHP configuration hardening example
# Add to php.ini or .htaccess to restrict file access scope
php_value open_basedir /var/www/html:/tmp