CVE-2025-60054
Published: 18 December 2025
Summary
CVE-2025-60054 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-60054 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, that enables PHP Local File Inclusion (CWE-98) in the OnLeash WordPress theme developed by AncoraThemes. This issue affects OnLeash versions from n/a through 1.5.2. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite requiring high attack complexity.
Remote, unauthenticated attackers can exploit this vulnerability over the network without user interaction. By manipulating filenames in PHP include/require statements, attackers can achieve local file inclusion, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized access to sensitive local files or server compromise.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/onleash/vulnerability/wordpress-onleash-theme-1-5-2-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion vulnerability in the OnLeash WordPress theme version 1.5.2. Security practitioners should review the advisory for mitigation guidance, including applying any available patches or upgrading to a fixed version beyond 1.5.2.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204131
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes OnLeash onleash allows PHP Local File Inclusion.This issue affects OnLeash: from n/a through <= 1.5.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a Local File Inclusion (LFI) in a public-facing WordPress theme via improper PHP include/require filename control, directly enabling exploitation of a public-facing application for initial access, sensitive file access, and potential server compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 enforces information input validation at entry points, directly preventing attackers from manipulating filenames supplied to PHP include/require statements to enable local file inclusion.
SI-2 requires timely identification, reporting, and remediation of system flaws, such as patching or upgrading the vulnerable OnLeash WordPress theme beyond version 1.5.2.
CM-6 establishes secure configuration settings for PHP, such as open_basedir restrictions or disabling allow_url_include, to limit the scope of potential local file inclusions.