CVE-2025-58708
📋 TL;DR
This vulnerability allows attackers to include local files on the server through improper filename control in PHP include/require statements. It affects WordPress websites using the 'triple-seven' theme from axiomthemes. Attackers can potentially read sensitive files or execute code.
💻 Affected Systems
- axiomthemes 777 triple-seven WordPress theme
📦 What is this software?
777 by Axiomthemes
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
Local file inclusion allowing reading of sensitive configuration files, database credentials, or other server files.
If Mitigated
Limited impact if file permissions are properly configured and sensitive files are protected.
🎯 Exploit Status
Simple HTTP requests can trigger the vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.3
Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/triple-seven/vulnerability/wordpress-777-theme-1-3-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Update to latest version of triple-seven theme. 2. Remove vulnerable theme if not needed. 3. Verify theme files are properly sanitized.
🔧 Temporary Workarounds
Disable vulnerable theme
allSwitch to default WordPress theme or another secure theme
wp theme activate twentytwentyfour
Restrict file inclusion
linuxConfigure PHP to disable allow_url_include and restrict open_basedir
allow_url_include = Off
open_basedir = /var/www/html
🧯 If You Can't Patch
- Implement web application firewall with LFI protection rules
- Restrict file system permissions and move sensitive files outside web root
🔍 How to Verify
Check if Vulnerable:
Check WordPress theme version in Appearance > Themes or wp-content/themes/triple-seven/style.cssCheck Version:
grep 'Version' wp-content/themes/triple-seven/style.cssVerify Fix Applied:
Verify theme version is greater than 1.3 and test file inclusion attempts return errors📡 Detection & Monitoring
Log Indicators:
- Unusual file path parameters in HTTP requests
- Multiple 404 errors for non-existent theme files
- PHP include/require warnings in error logs
Network Indicators:
- HTTP requests with file path traversal patterns
- Requests to theme files with unusual parameters
SIEM Query:
source="web_logs" AND (uri="*triple-seven*" AND (param="*../*" OR param="*file=*"))