CVE-2025-67523: 
WordPress vulnerability analysis and mitigation

CVE-2025-67523 is a PHP Local File Inclusion (LFI) vulnerability in the trippleS Exhibz WordPress theme, caused by improper control of filenames in PHP include/require statements. It affects all versions of the Exhibz theme up to and including 3.0.9, with version 3.0.10 containing the fix. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on November 13, 2025, and publicly disclosed on December 13, 2025. NVD assigned a CVSS v3.1 base score of 9.8 (Critical), while Patchstack rates it at 7.5 with a low exploitation priority (Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is passed unsanitized to PHP file inclusion functions (include/require). This allows an attacker to manipulate the filename parameter to traverse the server's file system and include arbitrary local files. According to Patchstack, exploitation requires at least Contributor or Developer-level privileges, which somewhat limits the attack surface despite the high CVSS score assigned by NVD. The vulnerability is categorized under OWASP Top 10 A3: Injection (Patchstack).

Successful exploitation allows an attacker to read sensitive local files on the web server, including configuration files containing database credentials, which could lead to complete database takeover. In more severe scenarios, if the server is configured to allow PHP execution of included files (e.g., via log poisoning or uploaded file inclusion), arbitrary code execution on the server may be achievable. The overall impact spans confidentiality (exposure of sensitive files and credentials), integrity (potential code execution enabling data modification), and availability (possible full application compromise) (Patchstack).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Patchstack). Patchstack classifies the exploitation priority as "Low," noting it is unlikely to be exploited in the near term. The EPSS score is approximately 0.053%, reflecting a low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The primary remediation is to update the Exhibz WordPress theme to version 3.0.10 or later, which contains the patch for this vulnerability (Patchstack). If an immediate update is not possible, site administrators should restrict file system permissions for the web application user, implement a Web Application Firewall (WAF) with rules targeting LFI patterns, and apply whitelisting of allowed files for any inclusion mechanisms. Monitoring web server access logs for path traversal patterns (e.g., ../, %2e%2e%2f) in request parameters is also recommended.

Wordfence included CVE-2025-67523 in its weekly WordPress vulnerability report for the period of December 8–14, 2025, highlighting it among other theme and plugin vulnerabilities disclosed that week (Wordfence Blog). Patchstack, the assigning CNA, characterized the issue as low priority with no impactful threat, noting the required privilege level limits mass exploitation risk. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed.