Confidant WordPress Theme CVE-2025-53440

Target site must have the Axiomthemes Confidant theme installed and active at version 1.4 or earlier; the vulnerable include sink must be reachable from the unauthenticated network surface (consistent with AV:N/PR:N/UI:N). The CVSS AC:H rating indicates non-default preconditions - likely a specific theme option, page-builder configuration, or request parameter sequence - must be satisfied to reach the file-inclusion primitive, though Patchstack's advisory does not enumerate them publicly. Exploitation is further limited to local files (LFI, not RFI), so the attacker must rely on files already present on the server (config, logs, session files, uploaded content) and cannot directly fetch a remote PHP payload via the include itself. Sites that have replaced or disabled the Confidant theme, or that run PHP with open_basedir or restrictive disable_functions, materially reduce realistic impact.

Signals are mixed. CVSS 8.1 with AV:N/PR:N/UI:N/C:H/I:H/A:H suggests a high-impact, network-reachable, unauthenticated vulnerability - typical of a serious LFI. However, AC:H (high attack complexity) tempers that score: NVD's AC:H usually means exploitation depends on a race condition, a specific configuration, or non-trivial preconditions the attacker cannot easily control. No EPSS score, no SSVC decision, and no KEV listing are provided, and no public proof-of-concept has been published - Patchstack is the sole intelligence source. The realistic priority is moderate-to-high for sites running this theme: LFI on WordPress historically pivots to RCE via log poisoning, session-file injection, or reading wp-config.php to steal DB credentials, but the AC:H caveat and lack of weaponized PoC argue against treating it as an emergency for sites that are not exposed to opportunistic mass scanning. Confidant is a niche commercial theme, so the absolute installed base is likely small, further limiting attacker interest.

An unauthenticated attacker discovers a Confidant ≤ 1.4 site (e.g., via Wappalyzer fingerprinting or a Google dork against theme asset paths) and sends a crafted HTTP request to the vulnerable theme endpoint with a manipulated filename parameter, traversing the filesystem to include /var/www/html/wp-config.php or a poisoned access log. The included file is parsed by PHP, leaking database credentials or executing attacker-supplied PHP previously written into a log file, which the attacker then pivots into webshell deployment and full WordPress takeover. No public PoC is currently known, and the CVSS AC:H rating implies a non-trivial parameter combination or timing is required to reach the vulnerable sink.