CVE-2025-60061
📋 TL;DR
This CVE describes a PHP Local File Inclusion vulnerability in the Kicker WordPress theme by axiomthemes. Attackers can include arbitrary local files through improper filename control in PHP include/require statements, potentially leading to sensitive data exposure or code execution. All WordPress sites using Kicker theme versions up to and including 2.2.0 are affected.
💻 Affected Systems
- axiomthemes Kicker WordPress theme
📦 What is this software?
Kicker by Axiomthemes
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through inclusion of malicious PHP files leading to remote code execution, data exfiltration, and complete site takeover.
Likely Case
Sensitive file disclosure (configuration files, database credentials, source code) and limited code execution within web server context.
If Mitigated
No impact if proper file permissions and web server configurations prevent access to sensitive files.
🎯 Exploit Status
LFI vulnerabilities in WordPress themes are commonly exploited. Public exploit details exist in the Patchstack reference.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2.2.0
Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/kicker/vulnerability/wordpress-kicker-theme-2-2-0-local-file-inclusion-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Check if Kicker theme update is available. 4. Update to latest version. 5. Alternatively, replace with secure theme.
🔧 Temporary Workarounds
Disable vulnerable theme
allSwitch to a different WordPress theme immediately
wp theme activate twentytwentyfour
wp theme delete kicker
Restrict PHP file inclusion
linuxAdd .htaccess rules to block LFI attempts
RewriteEngine On
RewriteCond %{QUERY_STRING} (.*)(include|require)(.*\.php) [NC]
RewriteRule ^.*$ - [F,L]
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block LFI patterns
- Restrict file permissions and disable dangerous PHP functions like allow_url_include
🔍 How to Verify
Check if Vulnerable:
Check WordPress theme version in wp-content/themes/kicker/style.css or via WordPress admin panelCheck Version:
wp theme list | grep kickerVerify Fix Applied:
Confirm Kicker theme version is greater than 2.2.0 or theme is deactivated📡 Detection & Monitoring
Log Indicators:
- Unusual file include patterns in web server logs
- Requests with ../ sequences or PHP file parameters
Network Indicators:
- HTTP requests with include/require parameters pointing to local files
SIEM Query:
source="web_logs" AND (uri="*include*" OR uri="*require*") AND (uri="*.php*" OR uri="*../*")