CVE-2025-67616: 
WordPress vulnerability analysis and mitigation

CVE-2025-67616 is a Local File Inclusion (LFI) vulnerability in the BZOTheme Mella WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Mella theme up to and including version 1.2.29. The vulnerability was published on January 22, 2026, by Patchstack, with CVSS v3.1 scoring added by CISA-ADP on January 28, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, NVD).

The root cause is improper control of filename parameters used in PHP include/require statements within the Mella WordPress theme (CWE-98). An attacker can manipulate user-supplied input that is passed unsanitized to a PHP file inclusion function, causing the server to include and execute arbitrary local files. Exploitation requires no authentication and no user interaction, though it is rated as high attack complexity, suggesting some precondition such as knowledge of file paths or specific server configurations must be met. No public proof-of-concept or detailed technical write-up has been identified at this time (Patchstack, NVD).

Successful exploitation of this vulnerability could allow a remote, unauthenticated attacker to include and execute arbitrary local files on the web server, resulting in high confidentiality, integrity, and availability impacts. An attacker could read sensitive files (e.g., WordPress configuration files containing database credentials), modify server data, or potentially achieve remote code execution if writable files or upload directories can be leveraged. This could further enable lateral movement within the hosting environment or full site compromise (NVD, Patchstack).

There is currently no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation for CVE-2025-67616. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, Patchstack).

No patch has been confirmed as available for the Mella theme at the time of disclosure. Site administrators running Mella version 1.2.29 or earlier should contact BZOTheme for guidance on available fixes or updates. As interim mitigations, consider deploying a Web Application Firewall (WAF) with rules to block file inclusion attempts (e.g., path traversal patterns like ../ or null bytes in parameters), restricting PHP file permissions, and monitoring web server logs for suspicious file inclusion requests. Disabling or replacing the theme until a patched version is released is also advisable (Patchstack, NVD).

The vulnerability was reported by Wordfence in their weekly WordPress vulnerability report covering January 12–18, 2026, indicating it received standard coverage within the WordPress security community. No notable researcher commentary or significant social media discussion has been identified beyond routine vulnerability tracking (Wordfence Blog).