CVE-2025-67615: 
WordPress vulnerability analysis and mitigation

CVE-2025-67615 is a Local File Inclusion (LFI) vulnerability in the bslthemes Myour WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Myour theme up to and including version 1.5.1. The vulnerability was published on January 22, 2026, by Patchstack, with CVSS v3.1 scoring added by CISA-ADP on January 28, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, NVD).

The root cause is improper control of filename parameters used in PHP include/require statements within the Myour theme (CWE-98), which despite being labeled 'PHP Remote File Inclusion,' manifests as a Local File Inclusion vulnerability in practice. An unauthenticated remote attacker can manipulate file path parameters passed to PHP inclusion functions, causing the server to include arbitrary local files. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or bypass is needed (e.g., specific server configuration or path traversal technique). The vulnerability is tracked under CAPEC-193 (PHP Remote File Inclusion) (Patchstack, NVD).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive configuration files (e.g., wp-config.php), credentials, and other server-side data. Depending on the files accessible and the server configuration, this could escalate to remote code execution if attacker-controlled content (e.g., uploaded files) can be included. The CVSS scoring reflects High impacts across confidentiality, integrity, and availability, indicating potential for full system compromise (NVD, Patchstack).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, NVD).

1. Reconnaissance: Identify WordPress sites using the Myour theme (version ≤ 1.5.1) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate the file inclusion parameter that is improperly sanitized in an include/require statement.
3. Craft malicious request: Construct an HTTP request (GET or POST) targeting the vulnerable endpoint with a manipulated filename parameter using path traversal sequences (e.g., ../../../../etc/passwd) to reference sensitive local files.
4. Achieve file inclusion: Submit the crafted request; if successful, the server returns the contents of the targeted local file, disclosing sensitive information such as credentials or configuration data.
5. Escalate to code execution (if applicable): If the server allows inclusion of attacker-uploaded files (e.g., via WordPress media upload), include a PHP web shell to achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs showing requests to Myour theme PHP files with suspicious filename parameters referencing system files (e.g., /etc/passwd, wp-config.php); HTTP 200 responses to such requests may indicate successful inclusion.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory or theme folder; modification timestamps on theme files inconsistent with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, or wget, which may indicate code execution following LFI exploitation.

Users should immediately upgrade the Myour theme to a version newer than 1.5.1 if a patched release is available from bslthemes. If no patch is available, administrators should disable or remove the Myour theme and switch to an alternative. Additional mitigations include implementing a Web Application Firewall (WAF) to detect and block path traversal and file inclusion attempts, restricting file system permissions to limit accessible files, and validating/sanitizing all user-supplied input used in file inclusion operations (Patchstack, NVD).

The vulnerability was reported by Wordfence in their weekly WordPress vulnerability report covering January 12–18, 2026, highlighting it as part of a broader set of WordPress theme vulnerabilities. No significant independent researcher commentary or widespread media coverage has been identified beyond standard vulnerability database listings (Wordfence).