CVE-2025-67525: 
WordPress vulnerability analysis and mitigation

CVE-2025-67525 is a PHP Local File Inclusion (LFI) vulnerability in the Opal_WP ekommart WordPress theme that allows unauthenticated remote attackers to include arbitrary local files. It affects all ekommart theme versions prior to 4.3.1. The vulnerability was reported on November 17, 2025, by researcher João Pedro S Alcântara (Kinorth), disclosed by Patchstack on December 15, 2025, and assigned a CVSS v3.1 base score of 9.8 (Critical) by NVD, though Patchstack rates it 7.5 (High) with a low exploitation priority (Patchstack).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which occurs when user-supplied input is passed unsanitized to PHP include or require statements within the ekommart theme. This allows an attacker to manipulate the file path parameter to include arbitrary local files from the server's filesystem. Exploitation requires Contributor or Developer-level privileges according to Patchstack's analysis, which reduces the practical risk compared to the NVD's unauthenticated assessment. The vulnerability is categorized under OWASP Top 10 A3: Injection and CAPEC-193 (PHP Remote File Inclusion) (Patchstack).

Successful exploitation allows an attacker to read sensitive files on the server, such as WordPress configuration files (wp-config.php) containing database credentials, potentially enabling full database takeover. Depending on server configuration, the vulnerability could also facilitate arbitrary code execution, leading to complete compromise of the WordPress site and the underlying server. Confidentiality, integrity, and availability are all rated as high impact by NVD (Patchstack).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. Patchstack classifies this as low priority with no impactful threat, noting that the required privilege level (Contributor/Developer) limits the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

The primary remediation is to update the ekommart WordPress theme to version 4.3.1 or later, which contains the fix for this vulnerability. As interim mitigations, administrators should implement strict input validation for file inclusion parameters, use whitelisting for allowed file paths, and configure PHP settings to disable remote file inclusion (allow_url_include = Off). Deploying a Web Application Firewall (WAF) with rules targeting LFI patterns can provide additional protection for sites that cannot immediately update (Patchstack).