CVE-2025-58894
📋 TL;DR
This vulnerability allows attackers to include local PHP files through improper filename control in the Good Mood WordPress theme. Attackers can potentially read sensitive files or execute arbitrary code. All WordPress sites using Good Mood theme version 1.16 or earlier are affected.
💻 Affected Systems
- axiomthemes Good Mood WordPress Theme
📦 What is this software?
Good Mood by Axiomthemes
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
Local file inclusion allowing sensitive file disclosure (like wp-config.php) and limited code execution.
If Mitigated
No impact if proper file permissions and web server configurations prevent PHP execution in sensitive directories.
🎯 Exploit Status
Exploitation requires crafting specific HTTP requests with file path parameters. Public exploit details available in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.17 or later
Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/good-mood/vulnerability/wordpress-good-mood-theme-1-16-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Check for Good Mood theme update. 4. Apply update to version 1.17+. 5. Clear cache if using caching plugins.
🔧 Temporary Workarounds
Disable vulnerable theme
allSwitch to default WordPress theme until patch is applied
wp theme activate twentytwentyfour
Web Application Firewall rule
allBlock requests containing local file inclusion patterns
🧯 If You Can't Patch
- Remove Good Mood theme completely and use alternative theme
- Implement strict file permissions (644 for files, 755 for directories) and disable PHP execution in uploads directory
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Appearance > Themes for Good Mood theme version 1.16 or earlierCheck Version:
wp theme list --name=good-mood --field=versionVerify Fix Applied:
Confirm Good Mood theme version is 1.17 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- HTTP requests with suspicious file path parameters like ../../../etc/passwd or wp-config.php
- PHP warnings about failed file inclusions
Network Indicators:
- Unusual GET/POST requests to theme files with file path parameters
- Traffic patterns suggesting directory traversal attempts
SIEM Query:
source="web_server" AND (uri="*good-mood*" AND (param="*../*" OR param="*php*"))