Cyber Posture

CVE-2025-60047

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes IPharm ipharm allows PHP Local File Inclusion.This issue affects IPharm: from n/a through <= 1.2.3.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the specific LFI flaw in the IPharm WordPress theme by identifying, reporting, and applying patches or updates.

SI-10 Information Input Validation good match
prevent

Enforces input validation mechanisms on filename parameters used in PHP include/require statements to block malicious local file paths.

SC-7 Boundary Protection partial match
preventdetect

Implements boundary protection such as web application firewalls to monitor and block network traffic attempting LFI exploitation patterns.

Security SummaryAI

CVE-2025-60047 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the IPharm WordPress theme developed by axiomthemes. The issue affects IPharm versions from an unspecified initial release through 1.2.3. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated remote attackers can exploit this vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling attackers to include and execute arbitrary local files on the server.

The Patchstack advisory provides further details on this WordPress theme vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Theme/ipharm/vulnerability/wordpress-ipharm-theme-1-2-3-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

Affected Products

axiomthemes
ipharm
≤ 1.2.3

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

LFI vulnerability in public-facing WordPress theme PHP code enables unauthenticated remote attackers to include and execute arbitrary local files, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References