CVE-2025-60085: Learnify Path Traversal Vulnerability

CVE-2025-60085 Overview

CVE-2025-60085 is an unauthenticated Local File Inclusion (LFI) vulnerability in the Learnify WordPress theme through version 1.15.0. The flaw is classified under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program. Attackers can include arbitrary local files into PHP execution flow without authentication, leading to source disclosure, configuration leakage, and potential code execution when chained with file upload primitives.

Critical Impact
Unauthenticated remote attackers can include local PHP files on the server, exposing sensitive data and enabling code execution paths that compromise confidentiality, integrity, and availability of WordPress sites running the Learnify theme.

Affected Products

Learnify WordPress theme versions 1.15.0 and earlier
WordPress installations using the vulnerable Learnify theme
Any PHP environment loading affected theme files

Discovery Timeline

2026-06-17 - CVE-2025-60085 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60085

Vulnerability Analysis

The Learnify theme processes user-supplied input and passes it to a PHP include or require statement without sufficient validation. This pattern, identified as PHP Remote File Inclusion / Local File Inclusion under CWE-98, allows attackers to control which file the PHP interpreter loads at runtime.

Because the vulnerability is reachable without authentication, any unauthenticated network actor can trigger inclusion logic over HTTP. The attack vector is network-based, requires no privileges, and needs no user interaction.

Successful inclusion of sensitive files such as wp-config.php exposes database credentials and authentication keys. When combined with uploaded content or log poisoning, the LFI primitive can escalate into arbitrary PHP execution within the WordPress process context.

Root Cause

The root cause is unsafe handling of a filename or path parameter that flows directly into a PHP include, include_once, require, or require_once call. The theme fails to enforce an allowlist of permitted templates and does not normalize traversal sequences before resolving the filesystem path.

Attack Vector

An attacker issues an HTTP request to a vulnerable Learnify endpoint, supplying a path parameter that references a local file. The PHP interpreter resolves the path, loads the file, and executes its contents in the WordPress runtime. Refer to the Patchstack Learnify Theme Vulnerability advisory for additional technical context.

// No verified proof-of-concept code is published.
// Refer to the Patchstack advisory for technical details.

Detection Methods for CVE-2025-60085

Indicators of Compromise

HTTP requests to Learnify theme endpoints containing path traversal sequences such as ../ or absolute filesystem paths
Web server access logs showing parameter values referencing wp-config.php, /etc/passwd, or PHP wrappers like php://filter
Unexpected outbound HTTP requests originating from the PHP-FPM or web server process after an inclusion event
New or modified PHP files in theme, plugin, or upload directories following suspicious request patterns

Detection Strategies

Inspect web access logs for query strings containing file path patterns directed at Learnify theme files
Deploy a Web Application Firewall (WAF) rule that blocks traversal sequences and PHP stream wrappers in request parameters
Monitor PHP error logs for failed to open stream and include() warnings referencing attacker-supplied paths
Baseline normal request parameters to Learnify endpoints and alert on deviations

Monitoring Recommendations

Enable verbose request logging on WordPress sites running Learnify until patched or removed
Forward web server and PHP logs to a centralized analytics platform for retrospective hunting
Track file integrity on wp-content/themes/learnify/ and core WordPress files to detect tampering
Alert on read access to sensitive files such as wp-config.php from the web server user context

How to Mitigate CVE-2025-60085

Immediate Actions Required

Identify all WordPress sites running the Learnify theme at version 1.15.0 or earlier
Disable or switch away from the Learnify theme until a fixed version is confirmed by the vendor
Rotate WordPress secret keys, database credentials, and administrative passwords if exposure is suspected
Apply WAF rules that block path traversal and PHP wrapper schemes in request parameters

Patch Information

No fixed version has been confirmed in the available NVD data at the time of publication. Consult the Patchstack Learnify Theme Vulnerability advisory for the latest vendor guidance and patched releases.

Workarounds

Restrict access to Learnify theme endpoints at the reverse proxy or WAF layer
Set PHP open_basedir to constrain filesystem reads to the WordPress document root
Disable PHP stream wrappers such as allow_url_include and limit allow_url_fopen where feasible
Apply least-privilege filesystem permissions so the web server user cannot read sensitive configuration outside the webroot

bash

# Example PHP hardening in php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"