CVE-2025-60198
Published: 06 November 2025
Summary
CVE-2025-60198 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 28.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the PHP Local File Inclusion flaw in the Saxon WordPress theme by requiring timely patching or updates beyond version 1.9.3 to prevent exploitation.
Enforces validation of filenames supplied to PHP include/require statements, blocking malicious inputs that enable local file inclusion attacks.
Establishes secure PHP configuration settings like open_basedir restrictions to limit the paths accessible via file inclusion vulnerabilities.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Public-facing WordPress theme LFI vulnerability exploited remotely without authentication (T1190), enabling arbitrary local file reads for sensitive data (T1005) including potential credentials in files like wp-config.php (T1552.001).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Saxon - Viral Content Blog & Magazine Marketing WordPress Theme saxon allows PHP Local File Inclusion.This issue affects Saxon - Viral Content Blog…
more
& Magazine Marketing WordPress Theme: from n/a through <= 1.9.3.
Deeper analysisAI
CVE-2025-60198 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the dedalx Saxon Viral Content Blog & Magazine Marketing WordPress Theme (saxon). This issue affects all versions from an unspecified initial release through 1.9.3. Published on 2025-11-06, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
Unauthenticated attackers with network access can exploit this vulnerability, though it requires high attack complexity and no user interaction. Exploitation via local file inclusion grants high-impact access to confidentiality, integrity, and availability, potentially allowing attackers to read sensitive local files, execute arbitrary code, or disrupt the affected WordPress site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/saxon/vulnerability/wordpress-saxon-viral-content-blog-magazine-marketing-wordpress-theme-theme-1-9-3-local-file-inclusion-vulnerability?_s_id=cve provides details on mitigation, including recommended patches or updates for the Saxon theme.
Details
- CWE(s)