CVE-2025-69034: Qodeinteractive Lekker Path Traversal

CVE-2025-69034 Overview

CVE-2025-69034 is a PHP Local File Inclusion (LFI) vulnerability in the Mikado-Themes Lekker WordPress theme. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers can abuse this weakness over the network without authentication to include arbitrary local files within the PHP execution context. The vulnerability affects all versions of the Lekker theme up to and including 1.8. Successful exploitation can lead to sensitive file disclosure, configuration leakage, and in some configurations arbitrary code execution through log poisoning or session file inclusion.

Critical Impact
Unauthenticated remote attackers can include arbitrary local PHP files, leading to information disclosure and potential code execution on affected WordPress sites.

Affected Products

Mikado-Themes Lekker WordPress theme versions through 1.8
WordPress installations using the Lekker theme by Qodeinteractive
Any site bundling vulnerable Lekker template files

Discovery Timeline

2025-12-30 - CVE-2025-69034 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2025-69034

Vulnerability Analysis

The Lekker theme accepts user-controlled input that is concatenated into a PHP include or require statement without proper sanitization. PHP file inclusion functions evaluate any included file as PHP code, meaning attackers gain script execution if they can influence which file is included. The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. Although the issue is categorized as Local File Inclusion, the entry point is reachable over the network through unauthenticated HTTP requests against the WordPress theme. Exploitation requires no user interaction but carries higher attack complexity, indicating non-trivial conditions to reliably reach the vulnerable code path.

Root Cause

The theme passes a request-controlled parameter into an inclusion function without validating it against an allow-list of expected templates. Path normalization and extension constraints are missing, allowing traversal sequences such as ../ and potentially null-byte tricks on older PHP versions. The result is that any readable file on the host filesystem can be loaded and parsed as PHP.

Attack Vector

An attacker sends a crafted HTTP request to a WordPress endpoint exposed by the Lekker theme, supplying a manipulated file path parameter. The server resolves the path relative to the theme directory and includes the targeted file. Attackers commonly chain LFI with log poisoning, uploaded media files, or PHP session files to escalate from disclosure to remote code execution. Refer to the Patchstack WordPress Vulnerability Report for the disclosure record.

Detection Methods for CVE-2025-69034

Indicators of Compromise

HTTP requests to Lekker theme endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes
Web server access logs showing query parameters referencing wp-config.php, /etc/passwd, or php://filter wrappers
Unexpected PHP errors referencing include() or require() failures within wp-content/themes/lekker/
Outbound requests or new PHP files appearing in upload directories following inclusion attempts

Detection Strategies

Inspect WordPress access logs for requests targeting Lekker theme PHP files with file path parameters
Deploy web application firewall (WAF) rules to flag traversal patterns and PHP wrapper schemes in query strings
Audit wp-content/themes/lekker/ for unauthorized file modifications or new PHP artifacts
Correlate include/require warnings in PHP error logs with originating client IPs

Monitoring Recommendations

Enable verbose PHP logging to capture file inclusion failures and the requested paths
Forward WordPress and web server logs to a central SIEM for traversal-pattern alerting
Monitor file integrity on theme directories and core WordPress configuration files
Track authentication and session activity for accounts active immediately after suspicious requests

How to Mitigate CVE-2025-69034

Immediate Actions Required

Identify all WordPress sites running the Mikado-Themes Lekker theme at version 1.8 or earlier
Disable or replace the Lekker theme until a patched version is confirmed available from the vendor
Restrict access to WordPress administrative and theme endpoints behind a WAF or IP allow-list
Rotate WordPress secrets in wp-config.php if inclusion attempts are observed in logs

Patch Information

At time of publication, no fixed version is listed in the NVD entry. The vulnerability affects Lekker versions from n/a through <= 1.8. Site administrators should consult the Patchstack WordPress Vulnerability Report and the vendor for an updated build before redeploying the theme.

Workarounds

Apply WAF signatures that block path traversal sequences and PHP stream wrappers in HTTP parameters
Configure PHP open_basedir to constrain file inclusion to the WordPress installation directory
Disable PHP wrappers such as allow_url_include and validate expose_php is set to Off
Remove unused Lekker template files that accept request-controlled inclusion parameters

bash

# Example php.ini hardening to limit LFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"