CVE-2025-58936
📋 TL;DR
This vulnerability allows attackers to include local files on the server through improper filename control in PHP include/require statements. It affects WordPress Catamaran theme users running versions up to and including 1.15, potentially leading to sensitive information disclosure or code execution.
💻 Affected Systems
- WordPress Catamaran Theme
📦 What is this software?
Catamaran by Axiomthemes
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through local file inclusion leading to remote code execution, sensitive file access (like /etc/passwd, configuration files), and complete system takeover.
Likely Case
Sensitive information disclosure from local files, partial code execution through PHP file inclusion, and potential privilege escalation.
If Mitigated
Limited impact with proper file permissions, web server restrictions, and PHP security settings in place.
🎯 Exploit Status
PHP local file inclusion vulnerabilities are commonly exploited. Public details available on Patchstack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: >1.15
Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/catamaran/vulnerability/wordpress-catamaran-theme-1-15-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Update Catamaran theme to latest version (>1.15) via WordPress admin panel. 2. Verify theme files are properly updated. 3. Clear any caching plugins.
🔧 Temporary Workarounds
Disable PHP allow_url_include
allPrevent PHP from including remote files via URL
php.ini: allow_url_include = Off
Restrict open_basedir
allLimit files PHP can access to specific directories
php.ini: open_basedir = /var/www/html:/tmp
🧯 If You Can't Patch
- Disable or remove Catamaran theme immediately
- Implement web application firewall (WAF) rules to block file inclusion patterns
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Appearance > Themes for Catamaran theme version <=1.15Check Version:
wp theme list --field=name,version --format=csv | grep catamaranVerify Fix Applied:
Confirm Catamaran theme version >1.15 in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in PHP error logs
- Requests with file inclusion parameters (include, require, file parameters)
Network Indicators:
- HTTP requests with file path traversal patterns
- Requests to theme files with suspicious parameters
SIEM Query:
source="web_access.log" AND (uri="*catamaran*" AND (param="*include*" OR param="*require*" OR param="*file*"))