CVE-2025-67925

Executive Summary

CVE-2025-67925 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Corpkit WordPress theme by Zozothemes, up to and including version 2.0. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading configuration files (e.g., wp-config.php), source code, or other system files. The CVSS score of 7.5 (High) reflects the ease of exploitation and the potential for significant data exposure. No public exploit code or patch is currently available, making this a high-priority unpatched risk for any site using the Corpkit theme.

Supply Chain & Package Security

This vulnerability resides in a WordPress theme distributed via the WordPress ecosystem. Since it is a commercial theme from Zozothemes, it is not available on the official WordPress.org repository. Users must obtain patches directly from the vendor. The lack of a known patch or advisory from Zozothemes increases supply chain risk, as site owners may be unaware of the vulnerability or unable to remediate it without vendor action.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can expose sensitive server files (e.g., database credentials, API keys). The lack of a patch makes it a persistent threat.

Deep Dive & Mechanics

The vulnerability is a PHP Local File Inclusion (LFI) caused by improper sanitization of a filename parameter used in a PHP include() or require() statement. In the Corpkit theme, a function likely processes user-supplied input (e.g., via a GET or POST parameter) to dynamically include template files or other resources. Without proper validation, an attacker can supply a path traversal sequence (e.g., ../../../../etc/passwd) to include arbitrary files from the server.

Root Cause: The theme fails to validate or sanitize the filename parameter, allowing directory traversal. The vulnerable code pattern is similar to:

include($_GET['file'] . '.php');

This allows an attacker to use null byte injection (in older PHP versions) or path traversal to bypass the appended extension, or simply include files without the extension if the code does not append one.

Attack Flow:

1. Attacker identifies a parameter (e.g., ?file=) in a Corpkit theme endpoint.
2. Attacker crafts a request with a path traversal payload: ?file=../../../../wp-config.php.
3. The server includes the file, executing its PHP code (if any) or outputting its contents.
4. Sensitive data (e.g., database credentials from wp-config.php) is disclosed.

Vulnerable vs. Patched Code

Vulnerable Code (Corpkit <= 2.0):

// Example vulnerable function in Corpkit theme
function corpkit_load_template($template) {
    include( get_template_directory() . '/templates/' . $template . '.php' );
}
// Called via: corpkit_load_template($_GET['template']);

This code directly concatenates user input into the file path without sanitization.

Patched Code (Hypothetical):

function corpkit_load_template($template) {
    // Whitelist allowed templates
    $allowed_templates = array('header', 'footer', 'sidebar');
    if (in_array($template, $allowed_templates)) {
        include( get_template_directory() . '/templates/' . $template . '.php' );
    } else {
        // Handle error
        wp_die('Invalid template.');
    }
}

A proper patch would implement a whitelist of allowed filenames, use realpath() to resolve the path and verify it is within the expected directory, and/or use basename() to strip directory traversal sequences.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site running Corpkit theme version <= 2.0.
• Knowledge of a vulnerable parameter (e.g., template, file, page).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web scanner or manual inspection to find parameters in the theme's URL structure. Common patterns: ?template=, ?file=, ?include=.
2. Test for LFI: Send a request with a path traversal payload:

   curl "http://target.com/?template=../../../../../../etc/passwd"
   

3. Read sensitive files: If successful, the contents of /etc/passwd will be displayed. For WordPress, target:

   curl "http://target.com/?template=../../../../wp-config.php"
   

   Note: PHP files will be executed, not displayed. To read PHP source code, use a PHP wrapper (if allowed) or try to include a non-PHP file (e.g., .txt).

Lab Setup:

• Use a local WordPress installation with Corpkit theme.
• Create a simple PHP script to simulate the vulnerable include:

  <?php
  // vulnerable.php
  $file = $_GET['file'];
  include($file . '.php');
  ?>
  

• Test with: http://localhost/vulnerable.php?file=../../../../etc/passwd

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e/, ....//).
• Look for requests to theme files with unexpected parameters.
• Use a WAF rule to block directory traversal sequences.

Mitigation:

• Immediately disable or remove the Corpkit theme if no patch is available.
• Implement a virtual patch via WAF (e.g., ModSecurity rule to block ../ in query strings).
• Restrict file permissions on the server to limit the impact of LFI.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ or %2e%2e/ in query parameters targeting Corpkit theme files.
  • Repeated requests to wp-content/themes/corpkit/ with suspicious parameters.
• File System IOCs:
  • Unexpected inclusion of files like /etc/passwd, /etc/shadow, or wp-config.php in web server logs.
• Log Patterns:
  • Apache/Nginx access logs showing GET /?template=../../../../etc/passwd HTTP/1.1 with 200 response.

Detection Engineering

YARA Rule

rule Detect_Corpkit_LFI_Exploit {
    meta:
        description = "Detects path traversal attempts targeting Corpkit theme LFI"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-67925"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/
        $corpkit_param = /(template|file|include)=/
    condition:
        any of ($path_traversal) and any of ($corpkit_param)
}

Sigma Rule

title: Corpkit Theme LFI Exploitation Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal patterns in HTTP requests targeting Corpkit theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
        cs-uri-stem|contains: '/wp-content/themes/corpkit/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67925 Corpkit Theme LFI Attempt"; flow:to_server,established; content:"/wp-content/themes/corpkit/"; http_uri; content:"../"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Corpkit theme and switch to a default WordPress theme (e.g., Twenty Twenty-Four) until a patch is available.
2. Apply a virtual patch using a Web Application Firewall (WAF) to block path traversal patterns in query strings.
3. Review server logs for signs of exploitation and rotate any exposed credentials (e.g., database passwords).

Long-Term Fix:

• Contact Zozothemes for an official patch. If none is forthcoming, consider replacing the theme permanently.
• Implement input validation and whitelisting for any file inclusion functionality in custom themes.
• Keep all WordPress components (core, themes, plugins) updated.

Workaround:

• If the theme cannot be disabled, modify the vulnerable PHP file to add a whitelist check (as shown in the patched code example). However, this may break theme functionality and should be done with caution.

Valters IT – DevSecOps & Cyber Threat Intelligence