CVE-2025-60054
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes OnLeash onleash allows PHP Local File Inclusion.This issue affects OnLeash: from n/a through <= 1.5.2.
Mitigating Controls (NIST 800-53 r5)AI
SI-10 enforces information input validation at entry points, directly preventing attackers from manipulating filenames supplied to PHP include/require statements to enable local file inclusion.
SI-2 requires timely identification, reporting, and remediation of system flaws, such as patching or upgrading the vulnerable OnLeash WordPress theme beyond version 1.5.2.
CM-6 establishes secure configuration settings for PHP, such as open_basedir restrictions or disabling allow_url_include, to limit the scope of potential local file inclusions.
Security SummaryAI
CVE-2025-60054 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, that enables PHP Local File Inclusion (CWE-98) in the OnLeash WordPress theme developed by AncoraThemes. This issue affects OnLeash versions from n/a through 1.5.2. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite requiring high attack complexity.
Remote, unauthenticated attackers can exploit this vulnerability over the network without user interaction. By manipulating filenames in PHP include/require statements, attackers can achieve local file inclusion, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized access to sensitive local files or server compromise.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/onleash/vulnerability/wordpress-onleash-theme-1-5-2-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion vulnerability in the OnLeash WordPress theme version 1.5.2. Security practitioners should review the advisory for mitigation guidance, including applying any available patches or upgrading to a fixed version beyond 1.5.2.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme via improper PHP include/require filename control, directly enabling exploitation of a public-facing application for initial access, sensitive file access, and potential server compromise.