CVE-2025-67528

Executive Summary

CVE-2025-67528 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Urna WordPress theme developed by Thembay. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to read arbitrary files from the server's filesystem. This can lead to the exposure of sensitive configuration files, database credentials, and source code. The affected version range is from n/a through 2.5.12. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The CVSS score is 7.5 (High), with a vector emphasizing network-based, low-complexity exploitation without authentication.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed via the official WordPress theme repository and potentially through third-party marketplaces. Users who have installed the Urna theme are at risk. Since the theme is a PHP application, the vulnerability lies in the theme's core code, not in the underlying web server (Apache or Nginx). The lack of a patch means that users must rely on manual mitigation or removal of the theme.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Complete file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The vulnerability is easy to exploit and can lead to full disclosure of sensitive server files.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI). It occurs when a PHP script uses a user-supplied input (e.g., via GET/POST parameters) to construct a file path for an include() or require() statement without proper sanitization. In the Urna theme, a parameter (likely page, template, or similar) is passed directly to an include function. An attacker can manipulate this parameter to include arbitrary files from the server, such as /etc/passwd, /wp-config.php, or other sensitive files.

The attack flow:

1. The attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /?page=../../../etc/passwd).
2. The theme's PHP code processes the page parameter and passes it to include().
3. The server includes the specified file, and its contents are output to the attacker.

Because the vulnerability is in a WordPress theme, it is triggered within the WordPress ecosystem. The theme's functions.php or a custom page template likely contains the vulnerable code.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern. A typical vulnerable snippet in a WordPress theme might look like:

// Vulnerable code (Urna theme <= 2.5.12)
$page = $_GET['page'];
include( $page . '.php' );

A patched version would sanitize the input, for example:

// Patched code (hypothetical)
$page = basename( $_GET['page'] );
$allowed_pages = array('home', 'about', 'contact');
if ( in_array( $page, $allowed_pages ) ) {
    include( $page . '.php' );
} else {
    // Handle error
}

The patch would restrict the include to a whitelist of allowed files and strip directory traversal characters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with Urna theme version <= 2.5.12.
• Knowledge of the vulnerable parameter (e.g., page, template, include).

Exploitation Steps:

1. Identify the vulnerable parameter by fuzzing common parameters like page, template, file, include, load.
2. Send a request to test for LFI:

   GET /?page=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If successful, the response will contain the contents of /etc/passwd.
4. To read WordPress configuration:

   GET /?page=../../../wp-config.php HTTP/1.1
   

   Note: PHP files will be executed, not displayed. To read source code, use a PHP wrapper like php://filter:

   GET /?page=php://filter/convert.base64-encode/resource=../../../wp-config.php HTTP/1.1
   

Lab Setup:

• Use a local WordPress installation with Docker:

  docker run -d --name wp -p 8080:80 wordpress:latest
  

• Download and install Urna theme version 2.5.12 from a vulnerable source.
• Activate the theme and test the exploit.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for suspicious GET parameters containing ../ or php://.
• Look for requests to non-existent PHP files or attempts to read system files.

Response:

• Immediately isolate the affected WordPress instance.
• Remove or disable the Urna theme.
• Check for signs of compromise (e.g., unexpected files, modified core files).
• Rotate any exposed credentials (database, API keys).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with parameters containing ../ (e.g., ?page=../../../etc/passwd).
  • Requests using php://filter or other PHP wrappers.
  • Unusual 200 OK responses to requests for system files.

• File System IOCs:

  • Presence of unexpected files in the web root (e.g., shells).
  • Modified WordPress core files or theme files.

• Log IOCs:

  • Web server access logs showing directory traversal patterns.
  • Error logs with PHP warnings about failed includes.

Detection Engineering

YARA Rule

rule CVE_2025_67528_LFI_Urna {
    meta:
        description = "Detects attempts to exploit CVE-2025-67528 LFI in Urna theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67528"
    strings:
        $traversal = /(\.\.\/){2,}/ nocase
        $php_wrapper = /php:\/\/filter/ nocase
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.env)/ nocase
    condition:
        any of ($traversal, $php_wrapper) and $sensitive_file
}

Sigma Rule

title: CVE-2025-67528 - Urna Theme LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in Urna WordPress theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'page=../'
            - 'template=../'
            - 'include=../'
            - 'php://filter'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67528 - Urna Theme LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"page="; http_uri; content:"../"; distance:0; within:10; content:"/etc/passwd"; distance:0; within:20; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Urna theme and switch to a default WordPress theme (e.g., Twenty Twenty-Four).
2. Remove the Urna theme from the server entirely.
3. Check for compromise by reviewing logs and scanning for backdoors.

Long-term Mitigation:

• Monitor the Thembay website for an official patch.
• If you must continue using the theme, implement a Web Application Firewall (WAF) rule to block directory traversal patterns.
• Apply the principle of least privilege to the web server user to limit the impact of file reads.

Code Fix (if you have access to the theme source):

• Locate the vulnerable include statement and replace it with a whitelist-based approach as shown in the "Vulnerable vs. Patched Code" section.

Valters IT
Securing Digital Frontiers