CVE-2025-54709
BaseFortify
Publication date: 2025-09-09
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | sala_theme | 1.1.7 |
| patchstack | sala_theme | 1.1.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-54709 is a high-severity Local File Inclusion (LFI) vulnerability in the WordPress Sala Theme versions up to 1.1.6. It allows unauthenticated attackers to include and display local files from the target website by exploiting improper control of filenames in include/require statements. This can expose sensitive information such as database credentials. [1]
How can this vulnerability impact me? :
Exploiting this vulnerability can lead to disclosure of sensitive local files, including database credentials. Attackers could use these credentials to take over the entire database depending on the site's configuration, resulting in a high risk to confidentiality, integrity, and availability of the affected system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this Local File Inclusion (LFI) vulnerability can involve monitoring for exploitation attempts that try to include local files via the Sala WordPress theme. While specific commands are not provided, typical detection methods include reviewing web server logs for suspicious requests attempting to include files, such as requests containing patterns like "include=", "require=", or file path traversal sequences (e.g., "../"). Additionally, using network monitoring tools to detect unusual HTTP requests targeting the Sala theme endpoints may help. Patchstack recommends professional incident response and server-side malware scanning rather than relying solely on plugin-based scanners, which may be tampered with by malware. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the virtual patch (vPatch) provided by Patchstack, which blocks exploitation attempts until you can update. The definitive fix is to update the WordPress Sala theme to version 1.1.7 or later, which fully resolves the vulnerability. Prompt updates and automated vulnerability mitigation are emphasized to protect against mass exploitation. In case of suspected compromise, professional incident response and server-side malware scanning are recommended. [1]