CVE-2025-60050
Published: 18 December 2025
Summary
CVE-2025-60050 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Panda. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of the vulnerable Panda WordPress theme to versions beyond 1.21.
Requires validation of filenames and paths in PHP include/require statements to block malicious local file inclusion inputs.
Enforces secure PHP configuration settings such as open_basedir restrictions to limit the scope of file inclusion even if flawed code exists.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing WordPress theme allows remote unauthenticated LFI, mapping to T1190 (Exploit Public-Facing Application) for initial exploitation and T1083 (File and Directory Discovery) via arbitrary local file access.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Panda panda allows PHP Local File Inclusion.This issue affects Panda: from n/a through <= 1.21.
Deeper analysisAI
CVE-2025-60050 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that allows PHP Local File Inclusion in the Panda WordPress theme developed by axiomthemes. This issue affects Panda versions from n/a through 1.21 and was published on 2025-12-18. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote, unauthenticated attackers can exploit this vulnerability over the network with high attack complexity and without requiring user interaction. Successful exploitation enables local file inclusion, potentially leading to high impacts on confidentiality, integrity, and availability, such as unauthorized access to sensitive files or system compromise.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/panda/vulnerability/wordpress-panda-theme-1-21-local-file-inclusion-vulnerability?_s_id=cve) documents this Local File Inclusion vulnerability specifically in WordPress Panda theme version 1.21.
Details
- CWE(s)