CVE-2025-58705: Crafti PHP Local File Inclusion (LFI) Vulnerability – Patch Guide

Technical summary

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which reflects inadequate input validation on file paths used in PHP's include() or require() directives. An unauthenticated remote attacker can manipulate input parameters to point include/require statements toward arbitrary files on the server filesystem. While the description notes this as a PHP Remote File Inclusion (RFI) risk, the primary impact is Local File Inclusion (LFI)—allowing attackers to read sensitive configuration files, source code, logs, or other local files; or to chain the LFI with local file upload/log poisoning techniques to achieve code execution. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-based attack with high complexity, requiring no privileges or user interaction, but delivering high impact on all three security properties.

Business impact

Organizations using Crafti risk unauthorized access to sensitive data stored on affected servers, including database credentials, API keys, customer information, and proprietary code. An attacker could also modify or delete files, or execute arbitrary code to establish persistence, pivot to adjacent systems, or deploy malware. For SaaS or managed hosting providers, a single compromised Crafti instance could expose multiple client environments. The CVSS 8.1 score reflects that while exploitation requires some technical sophistication (high complexity), the blast radius is severe once successful.

Affected systems

All Axiomthemes Crafti installations from the earliest tracked version through 1.12 are affected. Organizations should inventory all Crafti deployments immediately to determine exposure. Crafti is a WordPress theme/plugin framework; vulnerable instances are typically web-facing WordPress sites. The vulnerability is not limited to a specific hosting environment—it affects self-hosted, managed, and cloud-based WordPress deployments equally.

Exploitability

The vulnerability requires network access but no prior authentication or user interaction. However, the CVSS 'High Complexity' rating suggests that successful exploitation depends on factors such as server configuration, PHP settings (e.g., allow_url_include directives), or knowledge of the exact vulnerable parameter and valid file paths. This does not mean the vulnerability is obscure; it means an attacker must understand the target's filesystem structure or try multiple techniques. Public information about Crafti's architecture or any disclosed proof-of-concept would significantly lower the barrier to exploitation. The lack of KEV (Known Exploited Vulnerability) status does not imply the vulnerability is unexploited in the wild.

Remediation

Immediate action: Update Axiomthemes Crafti to a version newer than 1.12 as soon as vendor patches become available. Until a patch is released, implement compensating controls such as Web Application Firewall (WAF) rules to block requests with suspicious include/require parameters, restrict PHP's allow_url_include and allow_url_fopen settings to false, and limit filesystem permissions so the web server process cannot read sensitive files. Review server logs for signs of exploitation (unusual include/require requests, file access patterns). If a patch version is available, verify it against the official Axiomthemes security advisory before deployment.

Patch guidance

Check the Axiomthemes website and security advisories for a patched release newer than version 1.12. Apply patches in a staging environment first to validate compatibility with your WordPress configuration, plugins, and themes. Monitor Crafti's release notes and security mailing list for announcements. If using WordPress plugin/theme auto-update mechanisms, ensure they are enabled to minimize time between patch availability and deployment. After patching, verify the fix by reviewing the code changes and testing that include/require statements now properly validate and sanitize file paths.

Detection guidance

Search web server logs for HTTP requests containing suspicious parameters (e.g., file paths, null bytes, directory traversal sequences like ../, or protocol handlers like file://) targeting known or guessed Crafti endpoints. Look for PHP errors or warnings related to include/require failures in server error logs. Implement WAF rules to detect and block common LFI patterns (e.g., requests containing file path indicators). Use file integrity monitoring to alert on unauthorized reads of sensitive files (e.g., wp-config.php, .htaccess). Network IDS/IPS signatures may be available from threat intelligence feeds once public exploit details emerge. Scanner tools like Burp Suite, Acunetix, or OWASP ZAP can help identify vulnerable parameters in Crafti installations.

Why prioritize this

This vulnerability scores 8.1 (HIGH) and should be treated as urgent. It requires no authentication, is network-accessible, and grants an attacker read/write/execute capabilities on the server. While AC:H (High Complexity) indicates some exploitation hurdle, the impact—full server compromise—justifies immediate patching. Organizations should prioritize this above lower-severity issues. If you operate public-facing WordPress sites using Crafti, treat this as a critical security incident until patched.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: AV:N (Network—attacker needs only network access); AC:H (High Complexity—some technical know-how or reconnaissance required); PR:N (No privileges—unauthenticated attackers can attempt exploitation); UI:N (No user interaction needed); S:U (Scope Unchanged—impact is limited to the vulnerable component); C:H, I:H, A:H (High impact on all three security pillars—confidentiality, integrity, and availability are all compromised). The HIGH severity rating is justified given the combination of remote, unauthenticated attack surface and severe impact. The AC:H rating prevents a CRITICAL score, but this should not be underestimated.

Frequently asked questions