CVE-2025-60047
📋 TL;DR
This CVE describes a PHP Local File Inclusion vulnerability in the IPharm WordPress theme. Attackers can include arbitrary local files through improper filename control in include/require statements, potentially leading to sensitive information disclosure or code execution. All WordPress sites using IPharm theme versions up to 1.2.3 are affected.
💻 Affected Systems
- axiomthemes IPharm WordPress theme
📦 What is this software?
Ipharm by Axiomthemes
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and website defacement
Likely Case
Sensitive file disclosure (configuration files, database credentials) and limited code execution
If Mitigated
No impact if proper file permissions and web server configurations prevent file inclusion
🎯 Exploit Status
Simple path traversal or file inclusion payloads can exploit this vulnerability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.2.3
Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/ipharm/vulnerability/wordpress-ipharm-theme-1-2-3-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Update IPharm theme to latest version via WordPress admin panel
2. Verify theme version is >1.2.3
3. Clear WordPress cache if applicable
🔧 Temporary Workarounds
Disable vulnerable theme
allSwitch to default WordPress theme until patch is applied
wp theme activate twentytwentyfour
Restrict PHP file functions
linuxDisable dangerous PHP functions via php.ini
disable_functions = include,require,include_once,require_once
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file inclusion patterns
- Restrict file system permissions and implement strict access controls
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Appearance > Themes for IPharm theme versionCheck Version:
wp theme list --field=name,status,version | grep ipharmVerify Fix Applied:
Confirm theme version is >1.2.3 and test file inclusion attempts return errors📡 Detection & Monitoring
Log Indicators:
- Unusual file path requests in access logs
- PHP include/require errors with suspicious paths
Network Indicators:
- HTTP requests with ../ patterns or file inclusion parameters
SIEM Query:
source="web_access_logs" AND (uri="*../*" OR uri="*php://*" OR uri="*file=*")