CVE-2025-60060: Axiomthemes Pubzinne Path Traversal Flaw

CVE-2025-60060 Overview

CVE-2025-60060 is a Local File Inclusion (LFI) vulnerability affecting the Axiomthemes Pubzinne WordPress theme through version 1.0.12. The flaw stems from improper control of filename parameters used in PHP include or require statements, classified under [CWE-98]. Unauthenticated attackers can manipulate file path inputs over the network to load arbitrary local files into the PHP execution context. Successful exploitation can disclose sensitive configuration data, leak credentials from wp-config.php, or escalate to remote code execution when combined with file upload primitives. The issue impacts confidentiality, integrity, and availability of affected WordPress installations.

Critical Impact
Unauthenticated network attackers can include local PHP files, leading to sensitive information disclosure and potential code execution on WordPress sites running Pubzinne ≤ 1.0.12.

Affected Products

Axiomthemes Pubzinne WordPress theme — all versions through 1.0.12
WordPress installations using cpe:2.3:a:axiomthemes:pubzinne packages
Sites where the vulnerable theme is active and reachable from the internet

Discovery Timeline

2025-12-18 - CVE-2025-60060 published to NVD
2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-60060

Vulnerability Analysis

The vulnerability resides in PHP code within the Pubzinne theme that passes user-controlled input directly into an include, include_once, require, or require_once statement. Because the theme does not validate, sanitize, or restrict the filename parameter against an allow-list, an attacker can supply a crafted path that resolves to arbitrary files on the server filesystem. The PHP interpreter then evaluates the included file in the calling context, executing any PHP code it contains.

While the advisory categorizes this as PHP Remote File Inclusion ([CWE-98]), the practical exploitation path is Local File Inclusion because typical PHP deployments disable allow_url_include. Attackers can still read sensitive files such as wp-config.php, /etc/passwd, or session files, and may chain the LFI with log poisoning or uploaded media to achieve code execution.

Root Cause

The root cause is missing input validation on a filename parameter that is concatenated or passed into a PHP file inclusion call. The theme trusts the value supplied via an HTTP request parameter and does not constrain it to a fixed directory or whitelist of permitted templates.

Attack Vector

Exploitation requires only network access to a vulnerable WordPress site. No authentication or user interaction is needed. The attacker submits an HTTP request containing a manipulated path traversal sequence (for example, ../../../../wp-config.php) targeting the vulnerable theme endpoint. The high attack complexity reflects conditions such as path normalization or specific request shaping required to reach the sink reliably.

The vulnerability mechanism is described in the Patchstack WordPress Vulnerability Details. No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2025-60060

Indicators of Compromise

HTTP requests to Pubzinne theme paths containing ../ traversal sequences or absolute filesystem paths in query parameters
Web server access logs showing requests with parameter values referencing wp-config.php, /etc/passwd, or php://filter wrappers
Unexpected PHP errors in logs referencing include() or require() failures with attacker-supplied paths
Outbound connections or new admin users created shortly after suspicious theme requests

Detection Strategies

Inspect WordPress access logs for theme URLs combined with directory traversal patterns or PHP stream wrappers
Deploy web application firewall rules that flag file inclusion payloads against /wp-content/themes/pubzinne/ paths
Monitor file integrity on wp-config.php and theme directories for unauthorized read access patterns
Correlate PHP error logs with HTTP request logs to identify failed inclusion attempts that precede successful exploitation

Monitoring Recommendations

Enable verbose logging for PHP include and require failures and forward to a centralized SIEM
Alert on any HTTP parameter containing .., php://, file://, or data:// patterns reaching WordPress endpoints
Track creation of new PHP files within wp-content/uploads/ that could be used as inclusion targets

How to Mitigate CVE-2025-60060

Immediate Actions Required

Identify all WordPress sites using the Pubzinne theme and verify the installed version
Disable or switch away from the Pubzinne theme until a patched release is confirmed
Restrict access to the theme directory at the web server or WAF layer for non-essential endpoints
Rotate any secrets stored in wp-config.php if exploitation is suspected

Patch Information

At the time of NVD publication, no fixed version is listed; the issue affects Pubzinne from n/a through ≤ 1.0.12. Monitor the Patchstack advisory and the Axiomthemes vendor channels for an updated theme release and apply it immediately when available.

Workarounds

Set allow_url_include=Off and allow_url_fopen=Off in php.ini to limit remote inclusion exposure
Apply WAF signatures that block path traversal and PHP stream wrapper payloads on theme parameters
Use open_basedir restrictions to confine PHP file access to the WordPress installation directory
Replace the Pubzinne theme with a maintained alternative until a fix is published

bash

# php.ini hardening to reduce file inclusion impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"