CVE-2025-67526: 
WordPress vulnerability analysis and mitigation

CVE-2025-67526 is a Local File Inclusion (LFI) vulnerability in the ThimPress Sailing WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Sailing theme prior to 4.4.6. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on November 18, 2025, and publicly disclosed by Patchstack on December 15, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability stems from improper control of filename parameters used in PHP include/require statements within the Sailing WordPress theme (CWE-98). An authenticated attacker with at least Contributor or Developer-level privileges can manipulate file path inputs to cause the server to include arbitrary local files. The attack is delivered over the network but requires high complexity and low-privilege authentication, with no user interaction needed. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, credential theft, and potential further compromise of the WordPress installation and underlying server. Confidentiality, integrity, and availability are all rated as high impact (Patchstack).

No active in-the-wild exploitation has been reported, and Patchstack rates this vulnerability as low priority with no impactful threat currently observed. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor or Developer level, which raises the bar for opportunistic attackers (Patchstack).

1. Reconnaissance: Identify WordPress sites using the ThimPress Sailing theme with a version prior to 4.4.6 using tools like WPScan or by inspecting theme metadata in publicly accessible style.css files.
2. Obtain authenticated access: Acquire or compromise a WordPress account with at least Contributor or Developer-level privileges on the target site.
3. Identify vulnerable parameter: Locate the theme functionality that accepts a filename or path parameter passed to a PHP include/require statement without proper sanitization.
4. Craft malicious request: Submit a crafted HTTP request with a manipulated file path parameter (e.g., path traversal sequences like ../../../../wp-config.php) targeting the vulnerable theme endpoint.
5. Retrieve sensitive files: The server processes the malicious include and returns the contents of the targeted local file (e.g., database credentials from wp-config.php), which the attacker can use for further compromise (Patchstack).

• Logs: WordPress or web server access logs showing requests to Sailing theme endpoints with unusual file path parameters containing traversal sequences (e.g., ../, %2e%2e%2f) or references to sensitive files like wp-config.php.
• Network: Outbound connections from the web server to unexpected external hosts following theme endpoint requests, which may indicate chained exploitation.
• File System: Unexpected new files or modified theme files within the Sailing theme directory; presence of web shells or backdoors in the WordPress installation.
• Logs: Authentication logs showing Contributor or Developer-level accounts logging in from unfamiliar IP addresses prior to suspicious theme requests.

The vendor ThimPress has released version 4.4.6 of the Sailing WordPress theme, which patches this vulnerability. Site administrators should update the Sailing theme to version 4.4.6 or later immediately. If an immediate update is not possible, consider restricting Contributor and Developer role access, or use a web application firewall (WAF) solution such as Patchstack to virtually patch the vulnerability while an update is prepared (Patchstack).

Wordfence included CVE-2025-67526 in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, indicating routine tracking by the WordPress security community (Wordfence). Patchstack, the assigning CNA, classified the vulnerability as low priority with no impactful threat, suggesting limited concern from the broader security community at this time (Patchstack).