HomeRoofer Theme CVE-2025-58954

Exploitation requires the target WordPress site to have the ThemeRex HomeRoofer theme installed and activated at version 2.11.0 or earlier, with the vulnerable theme endpoint reachable over HTTP/HTTPS from the attacker's network position; no WordPress account, user interaction, or admin session is needed (PR:N, UI:N). The AC:H rating in the supplied CVSS vector indicates a non-trivial precondition - likely that the attacker must know or guess the absolute or relative path to a sensitive file, that PHP's allow_url_include or specific stream wrappers must be available to escalate beyond file read, or that server-side filters must be bypassed via encoding. Exploitation is limited by hardening such as open_basedir, disabled PHP wrappers, WAF rules blocking traversal patterns, and by the fact that only files readable by the web-server user can be disclosed.

The supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) reflects unauthenticated network reachability with high confidentiality, integrity, and availability impact, tempered by AC:H - Patchstack likely assigned high attack complexity because successful exploitation depends on specific server-side preconditions (e.g. PHP configuration permitting traversal, knowledge of file layout, or wrapper availability). I/A:H suggest the cataloguer believes LFI here can be escalated beyond pure read, plausibly via log poisoning, session file inclusion, or PHP filter chains. No EPSS, KEV, or POC indicator was provided, so exploitation likelihood cannot be quantitatively scored; however, ThemeRex themes are widely deployed and LFI patterns in WordPress themes are routinely weaponized once disclosed. Treat this as a real priority for any site running HomeRoofer because the authentication barrier is zero, even though commodity mass-exploitation evidence is currently absent.

An unauthenticated attacker sends an HTTP request to a vulnerable HomeRoofer theme endpoint with a manipulated file/template parameter containing traversal sequences, causing PHP to include /var/www/html/wp-config.php and return its contents - yielding database credentials and WordPress auth keys. The attacker then reuses the credentials to access the database directly or escalates to RCE by chaining the LFI with log poisoning or a PHP filter wrapper to execute attacker-supplied PHP.