CVE-2025-67528: 
WordPress vulnerability analysis and mitigation

CVE-2025-67528 is a Local File Inclusion (LFI) vulnerability in the Urna WordPress theme developed by thembay. It affects all versions of the Urna theme up to and including 2.5.12, and was patched in version 2.5.13. The vulnerability was reported by João Pedro S Alcântara (Kinorth) on November 20, 2025, and publicly disclosed on December 9–15, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is classified as CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion/Local File Inclusion). The vulnerability arises from insufficient validation of user-supplied input used in PHP file inclusion statements within the Urna theme, allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server. Exploitation requires low privileges (Contributor or Developer level) and no user interaction, but has high attack complexity, limiting opportunistic exploitation. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, such as configuration files containing database credentials, WordPress wp-config.php, or other sensitive data. This could lead to complete database takeover, credential theft, and further lateral movement within the hosting environment. Confidentiality, integrity, and availability are all rated as high impact in the CVSS scoring (Patchstack).

No active in-the-wild exploitation has been confirmed, and Patchstack rates this vulnerability as low priority with no impactful threat observed. The EPSS score is approximately 0.051%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that LFI vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Urna theme (version ≤ 2.5.12) via web fingerprinting tools such as WPScan or by inspecting theme metadata in page source.
2. Obtain low-privilege access: Gain Contributor or Developer-level access to the target WordPress site, either through credential theft, brute force, or social engineering.
3. Identify vulnerable parameter: Locate the theme's PHP file inclusion mechanism that accepts user-controlled input for the filename or template path parameter.
4. Craft malicious request: Submit a crafted request with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php) to trigger the LFI.
5. Exfiltrate data: Review the server's response to extract credentials, configuration data, or other sensitive file contents for further exploitation (Patchstack).

• Logs: WordPress access logs showing requests with path traversal sequences (e.g., ../, %2e%2e%2f) in theme-related parameters; repeated HTTP requests to theme template endpoints with unusual filename values.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or database configuration files by the web server process.
• Network: Outbound connections from the web server following suspicious file inclusion requests, potentially indicating secondary payload delivery.
• Process: Unusual PHP process activity reading files outside the WordPress web root directory.

The vendor (thembay) has released version 2.5.13 of the Urna WordPress theme, which patches this vulnerability. Site administrators should update to version 2.5.13 or later immediately. If an immediate update is not possible, restrict Contributor and Developer role assignments to trusted users only, and consider using a WordPress security plugin (such as Patchstack or Wordfence) to apply virtual patching until the update can be applied (Patchstack).

Wordfence included CVE-2025-67528 in its weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, indicating routine tracking by the WordPress security community (Wordfence). Patchstack, which coordinated the disclosure, rates the vulnerability as low priority with no impactful threat observed in the wild. No significant social media discussion or broader media coverage has been identified.