Critical LFI in WordPress Madara Theme (CVE‑2025‑4524) Exposes Server Files

Critical Local File Inclusion in WordPress Madara Theme (CVE‑2025‑4524) Affects Sites Using the Madara Plugin

What Happened – A publicly disclosed vulnerability (CVE‑2025‑4524) in the Madara WordPress theme enables an attacker to perform a Local File Inclusion (LFI) via a crafted admin‑ajax.php request. By traversing directory paths the exploit can read arbitrary files such as /etc/passwd.

Why It Matters for TPRM –

• LFI can expose internal configuration, credential files, or other sensitive data on any third‑party website that runs the Madara theme.
• Attackers may chain the LFI with other exploits to achieve remote code execution, jeopardizing the broader supply chain.
• Many organizations outsource their web presence to agencies or SaaS platforms that rely on pre‑built WordPress themes, expanding the attack surface beyond internal teams.

Who Is Affected – Companies across all sectors that host public‑facing WordPress sites using the Madara theme (commonly media, publishing, manga/comic portals, and any SaaS‑based web‑hosting providers).

Recommended Actions –

• Inventory all WordPress installations and verify whether the Madara theme (any version) is deployed.
• Apply the vendor‑released patch or upgrade to the latest Madara version that addresses CVE‑2025‑4524.
• If patching is not immediately possible, block unauthenticated POST requests to admin‑ajax.php that contain the madara_load_more action.
• Conduct a file‑integrity scan for signs of unauthorized reads or tampering.

Technical Notes – The exploit sends a POST request to wp-admin/admin-ajax.php with the parameter template=plugins/../../../../../../../etc/passwd. The vulnerability stems from insufficient path sanitisation in the Madara theme’s AJAX handler, allowing arbitrary file reads. No CVE‑specific CVSS score is published yet, but the impact is considered High due to potential credential exposure. Source: Exploit‑DB #52487