CVE-2025-69058: PartyMaker Path Traversal Vulnerability

CVE-2025-69058 Overview

CVE-2025-69058 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes PartyMaker WordPress theme. The flaw stems from improper control of filename arguments passed to PHP include or require statements [CWE-98]. Attackers can manipulate file path parameters to load arbitrary local files through the PHP interpreter. The vulnerability affects all PartyMaker versions up to and including 1.1.15. Successful exploitation can expose sensitive server-side files, configuration data, or lead to remote code execution when combined with file upload primitives. The issue is tracked in the Patchstack Vulnerability Report.

Critical Impact
Unauthenticated attackers can include arbitrary local PHP files, exposing sensitive data and potentially achieving remote code execution on WordPress sites running PartyMaker ≤ 1.1.15.

Affected Products

AncoraThemes PartyMaker WordPress Theme versions up to and including 1.1.15
WordPress installations using the PartyMaker theme as active or parent theme
WordPress child themes that inherit vulnerable PartyMaker template files

Discovery Timeline

2026-01-22 - CVE-2025-69058 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-69058

Vulnerability Analysis

The vulnerability arises from PartyMaker passing user-controlled input directly into PHP file inclusion functions such as include, include_once, require, or require_once. The theme accepts a filename parameter through an HTTP request and uses it to load a PHP template or component without sufficient sanitization. Attackers can supply traversal sequences like ../../ or absolute paths to point the inclusion at arbitrary files on the server. When the targeted file contains PHP code, the interpreter executes it within the WordPress application context. When it contains static data, the contents are rendered in the HTTP response, leaking secrets such as wp-config.php credentials.

Root Cause

The root cause is missing or insufficient validation of filename input prior to its use in PHP file inclusion functions [CWE-98]. The theme does not constrain the input to an allowlist of expected template names. It also does not normalize the path before inclusion, leaving directory traversal sequences intact.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. Attackers send a crafted HTTP request to a vulnerable PartyMaker endpoint containing a manipulated filename parameter. The request must satisfy specific preconditions, which contributes to the higher attack complexity rating. Successful exploitation grants the attacker the ability to read or execute arbitrary local files accessible to the PHP process.

The vulnerability mechanism is described in detail in the Patchstack advisory. No public proof-of-concept code has been released at this time.

Detection Methods for CVE-2025-69058

Indicators of Compromise

HTTP requests to PartyMaker theme endpoints containing path traversal sequences such as ../, ..%2F, or ..%5C in query parameters
Web server access logs showing requests referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files
Unexpected outbound network connections originating from the PHP-FPM or web server process following theme requests
Modifications to WordPress core files, theme files, or the appearance of unknown PHP files in upload directories

Detection Strategies

Inspect web server logs for requests targeting PartyMaker template loader scripts with filename, page, or path parameters containing traversal patterns
Deploy web application firewall (WAF) signatures that detect directory traversal payloads and PHP wrapper schemes such as php://filter and data://
Monitor PHP error logs for failed to open stream or include warnings referencing non-standard paths

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation directory to flag unauthorized file creation or modification
Alert on PHP processes spawning shell interpreters, curl, wget, or other binaries outside normal application behavior
Forward WordPress, PHP, and web server logs to a centralized analytics platform for correlation with threat intelligence

How to Mitigate CVE-2025-69058

Immediate Actions Required

Identify all WordPress sites running the AncoraThemes PartyMaker theme at version 1.1.15 or earlier
Apply the vendor patch as soon as a fixed version is published by AncoraThemes, or deactivate the theme until a fix is available
Audit web server and WordPress logs for prior exploitation attempts referencing PartyMaker endpoints with traversal payloads
Rotate WordPress database credentials, authentication keys, and salts in wp-config.php if exposure is suspected

Patch Information

At the time of publication, the vulnerability affects PartyMaker through version 1.1.15. Administrators should consult the Patchstack Vulnerability Report and the AncoraThemes vendor channel for the latest fixed release.

Workarounds

Deploy a virtual patch via a WordPress security plugin or WAF rule that blocks directory traversal sequences in HTTP parameters targeting theme files
Set open_basedir in php.ini to restrict PHP file access to the WordPress installation directory and required subdirectories
Disable PHP URL inclusion by setting allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent remote file inclusion escalation
Restrict web server access to PartyMaker template loader endpoints to authenticated administrators where feasible

bash

# Configuration example - php.ini hardening to limit LFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html/wordpress:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"