CVE-2025-69158: Granola Path Traversal Vulnerability

CVE-2025-69158 Overview

CVE-2025-69158 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Granola WordPress theme in versions 1.13 and earlier. The flaw is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program). Remote attackers can request crafted parameters to force the theme to include arbitrary local files, leading to disclosure of sensitive data or execution of attacker-controlled PHP code if a writable path is reachable.

Critical Impact
Unauthenticated attackers can include arbitrary files on the server, exposing configuration secrets and potentially achieving remote code execution on WordPress sites running the Granola theme.

Affected Products

Granola WordPress theme, versions <= 1.13
WordPress sites with the Granola theme active
Hosting environments running PHP with allow_url_include or writable include paths exposed

Discovery Timeline

2026-06-17 - CVE-2025-69158 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-69158

Vulnerability Analysis

The Granola theme accepts user-controlled input that is passed into a PHP include or require statement without proper sanitization or allow-listing. Because the input flows directly to the file inclusion sink, attackers can manipulate the path argument to load files outside the theme directory. The issue does not require authentication, so anyone able to reach the affected endpoint over the network can trigger it.

The EPSS score is 0.348% (percentile 26.5), indicating limited observed exploitation activity at publication. However, LFI flaws in WordPress themes are frequently weaponized once disclosure occurs, since theme paths are easily fingerprinted.

Root Cause

The root cause is improper control of the filename passed to a PHP file inclusion function, mapped to [CWE-98]. The vulnerable code path consumes a request parameter and concatenates it into the argument of include, include_once, require, or require_once without restricting the value to a known set of safe templates. Directory traversal sequences such as ../ and absolute paths are not filtered.

Attack Vector

The attack vector is Network. An unauthenticated attacker issues an HTTP request to the vulnerable endpoint exposed by the Granola theme, supplying a path parameter that resolves to a sensitive file on disk (for example wp-config.php) or to an uploaded file containing PHP. The server processes the included file in the context of the WordPress process, leaking secrets such as database credentials or executing attacker code. See the Patchstack Granola Theme Vulnerability advisory for further technical details.

No verified public proof-of-concept code is available at the time of writing. The vulnerability is described in prose because no realCodeExamples were provided.

Detection Methods for CVE-2025-69158

Indicators of Compromise

HTTP requests to Granola theme paths containing traversal sequences such as ../, ..%2f, or null bytes
Requests with parameters referencing sensitive files like wp-config.php, /etc/passwd, or php://filter
Web server logs showing 200 responses to anomalous query strings targeting theme PHP files
Unexpected PHP process activity originating from theme template files

Detection Strategies

Inspect web access logs for query parameters containing path traversal patterns directed at /wp-content/themes/granola/
Apply Web Application Firewall (WAF) rules that flag LFI payloads, including php://filter/convert.base64-encode/resource= patterns
Correlate anomalous file read events on the WordPress host with inbound HTTP requests to the Granola theme

Monitoring Recommendations

Enable WordPress audit logging for theme file access and plugin activity
Forward web server and PHP-FPM logs to a centralized analytics platform for retrospective hunting
Alert on outbound connections initiated by the PHP process, which can indicate post-exploitation activity

How to Mitigate CVE-2025-69158

Immediate Actions Required

Identify all WordPress sites running the Granola theme at version 1.13 or earlier
Deactivate the Granola theme until a patched release is installed if a fix is available
Restrict access to the WordPress site through WAF rules that block path traversal sequences in query parameters
Rotate any secrets stored in wp-config.php if exploitation is suspected

Patch Information

At the time of publication, refer to the Patchstack Granola Theme Vulnerability advisory for the latest fixed version information and vendor guidance. Upgrade to a release later than 1.13 once published by the theme maintainer.

Workarounds

Use a WAF or reverse proxy to block requests containing ../, encoded traversal sequences, or php:// wrappers
Set the PHP directive open_basedir to restrict file access to the WordPress document root
Disable allow_url_include in php.ini to prevent remote file inclusion escalation
Apply least-privilege filesystem permissions so the web server cannot read sensitive system files

bash

# Configuration example: harden PHP against LFI exploitation
# /etc/php/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"