CVE-2025-69171: Orpheus Path Traversal Vulnerability

CVE-2025-69171 Overview

CVE-2025-69171 is an unauthenticated Local File Inclusion (LFI) vulnerability affecting the Orpheus WordPress theme in versions 1.3 and earlier. The flaw maps to [CWE-98], improper control of filename for include/require statement in PHP programs. Remote attackers can include arbitrary local files through the vulnerable theme without authentication. Successful exploitation can disclose sensitive configuration data, source code, and credentials, and may enable code execution if attacker-controlled content reaches an included path. Patchstack published the advisory in its WordPress vulnerability database.

Critical Impact
Unauthenticated attackers can include local files through the Orpheus theme, exposing sensitive data such as wp-config.php and potentially escalating to remote code execution.

Affected Products

Orpheus WordPress theme version 1.3
Orpheus WordPress theme prior versions (<= 1.3)
WordPress sites running the vulnerable Orpheus theme

Discovery Timeline

2026-06-17 - CVE-2025-69171 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-69171

Vulnerability Analysis

The Orpheus theme fails to sanitize a user-controlled parameter before passing it to a PHP include or require statement. An unauthenticated attacker supplies a crafted path value over HTTP, and the theme resolves it against the local filesystem. PHP then reads and interprets the targeted file in the context of the web server process. The advisory classifies the flaw as Local File Inclusion under [CWE-98], improper control of filename for include/require statement.

Root Cause

The root cause is missing input validation on a filename or path parameter consumed by a PHP include directive. The theme accepts attacker-supplied input directly into the include path without an allowlist, canonicalization, or extension check. Path traversal sequences such as ../ traverse outside the theme directory. The dynamic include resolves arbitrary files readable by the PHP process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to the vulnerable Orpheus theme endpoint with a manipulated path parameter. Targets include WordPress configuration files, system files such as /etc/passwd, and log files used for log poisoning. When an attacker can write attacker-controlled content into an includable file, the LFI chain pivots to arbitrary PHP execution.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2025-69171

Indicators of Compromise

HTTP requests to Orpheus theme PHP files containing path traversal sequences such as ../../, ..%2f, or encoded null bytes
Web server log entries showing parameter values referencing wp-config.php, /etc/passwd, /proc/self/environ, or PHP wrappers like php://filter
Unexpected PHP process reads of files outside the theme directory tree
Outbound connections or file writes initiated by the web server user shortly after suspicious include requests

Detection Strategies

Inspect web access logs for query strings targeting Orpheus theme paths with traversal patterns or sensitive filenames
Deploy a web application firewall rule matching LFI signatures, including php://filter, data://, and traversal encodings, on requests to /wp-content/themes/orpheus/
Enable PHP open_basedir and review violations as high-fidelity indicators of include path abuse

Monitoring Recommendations

Forward WordPress and web server logs to a centralized analytics platform and alert on Orpheus theme requests containing .. or non-ASCII path encodings
Monitor file integrity on wp-config.php and upload directories for unauthorized reads or new PHP payloads
Track outbound connections from the PHP-FPM or web server process to flag post-exploitation activity

How to Mitigate CVE-2025-69171

Immediate Actions Required

Identify all WordPress instances running the Orpheus theme version 1.3 or earlier and disable the theme until a fixed release is confirmed
Restrict access to the WordPress site behind a web application firewall with LFI and path traversal rules enabled
Rotate any credentials, API keys, and database secrets stored in wp-config.php if exploitation is suspected
Review web server access logs for prior exploitation attempts targeting Orpheus theme endpoints

Patch Information

At the time of publication, the Patchstack advisory lists Orpheus <= 1.3 as vulnerable. Consult the Patchstack WordPress Vulnerability Report for the current patch status and upgrade guidance. Apply vendor updates as soon as a fixed version becomes available.

Workarounds

Switch to an alternative WordPress theme until a patched Orpheus release is published
Configure PHP open_basedir to constrain include paths to the WordPress installation directory
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to limit secondary inclusion vectors
Deploy WAF virtual patching rules that block traversal sequences and PHP stream wrappers on requests to the Orpheus theme path

bash

# Configuration example: restrict PHP include scope and disable risky wrappers
# /etc/php/8.x/fpm/php.ini
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off

# Apache: block traversal on Orpheus theme path
<LocationMatch "/wp-content/themes/orpheus/">
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f|php://|data://) [NC]
    RewriteRule .* - [F,L]
</LocationMatch>