CVE-2025-58933
📋 TL;DR
This vulnerability allows attackers to include local PHP files through improper filename control in the Anubis WordPress theme. Attackers can potentially read sensitive files or execute arbitrary code on affected WordPress installations. All WordPress sites using vulnerable versions of the Anubis theme are affected.
💻 Affected Systems
- axiomthemes Anubis WordPress Theme
📦 What is this software?
Anubis by Axiomthemes
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through arbitrary code execution leading to data theft, ransomware deployment, or complete site takeover.
Likely Case
Sensitive file disclosure (configuration files, database credentials) leading to further attacks or data exfiltration.
If Mitigated
Limited impact with proper file permissions and web server restrictions preventing file inclusion.
🎯 Exploit Status
Simple HTTP requests can trigger the vulnerability. Public exploit details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.25
Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/anubis/vulnerability/wordpress-anubis-theme-1-25-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Update the Anubis theme to the latest version via WordPress admin panel. 2. Alternatively, download the latest version from the theme repository and replace the existing theme files.
🔧 Temporary Workarounds
Disable vulnerable theme
allSwitch to a different WordPress theme until patched
wp theme activate twentytwentyfour
wp theme deactivate anubis
Restrict PHP file inclusion
allAdd web server rules to block file inclusion attempts
# Apache: Add to .htaccess
<FilesMatch "\.(php|inc)$">
Order Deny,Allow
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~ \.(php|inc)$ {
deny all;
}
🧯 If You Can't Patch
- Remove the Anubis theme completely from the WordPress installation
- Implement web application firewall (WAF) rules to block file inclusion patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress theme version in Appearance > Themes or run: wp theme list --field=name,version | grep anubisCheck Version:
wp theme list --field=name,version | grep anubisVerify Fix Applied:
Confirm theme version is greater than 1.25 and test file inclusion attempts return errors instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests with file inclusion parameters like ?file=../../etc/passwd
- PHP warnings about failed file inclusions
- Unusual file access patterns in web server logs
Network Indicators:
- HTTP requests containing path traversal sequences (../)
- Requests to theme files with unusual parameters
SIEM Query:
web_access_logs WHERE url CONTAINS 'anubis' AND (url CONTAINS '../' OR url CONTAINS 'file=' OR url CONTAINS 'include=')