CVE-2025-67924: 
WordPress vulnerability analysis and mitigation

CVE-2025-67924 is an Unrestricted File Upload vulnerability (CWE-434) in the zozothemes Corpkit WordPress theme that allows attackers to upload web shells to a web server. It affects Corpkit versions up to and including 2.0, with version 2.0.1 identified as the patched release. The vulnerability was reported by researcher "Bonds" on October 19, 2025, and published by Patchstack on January 5–8, 2026. It carries a CVSS v3.1 base score of 9.9 (Critical) as assessed by Patchstack, requiring only Subscriber-level privileges (Patchstack, NVD).

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the Corpkit theme fails to properly validate or restrict the types of files that can be uploaded by authenticated users. A low-privileged user (Subscriber level) can exploit this flaw to upload arbitrary file types — including PHP web shells — to the web server. Because uploaded files are likely stored in a web-accessible directory without execution restrictions, the attacker can subsequently request the uploaded file to trigger server-side code execution. No public proof-of-concept code has been disclosed at this time (Patchstack, NVD).

Successful exploitation allows an attacker to upload and execute arbitrary code on the web server, effectively achieving full remote code execution (RCE). This can lead to complete server compromise, including theft of sensitive data (database credentials, user PII), defacement or deletion of website content, installation of persistent backdoors, and disruption of service availability. The broad scope of impact — high confidentiality, integrity, and availability — makes this a critical risk for any WordPress site running the affected theme (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no confirmed evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their traffic or popularity, and has issued a virtual patch (mitigation rule) for its users (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Corpkit theme version ≤ 2.0 using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/themes/corpkit).
2. Obtain low-privilege access: Register or obtain a Subscriber-level account on the target WordPress site, as the vulnerability requires at minimum this privilege level.
3. Craft malicious upload request: Prepare a PHP web shell file (e.g., shell.php) and submit it via the theme's file upload functionality, bypassing any client-side file type restrictions.
4. Locate the uploaded file: Determine the upload path within the web-accessible directory (typically under wp-content/uploads/ or a theme-specific directory).
5. Execute the web shell: Send an HTTP GET or POST request to the uploaded shell's URL to trigger server-side PHP execution, gaining an interactive command interface on the server.
6. Post-exploitation: Use the shell to exfiltrate wp-config.php (database credentials), establish persistence via additional backdoors, or pivot to other systems on the network (Patchstack).

• File System: Unexpected PHP files (e.g., shell.php, cmd.php, files with random names) in wp-content/uploads/ or theme directories; files with PHP execution capability in upload folders.
• Network: HTTP requests to newly created .php files in upload directories, especially with parameters like cmd=, exec=, or c=; outbound connections from the web server process to unknown external IPs.
• Logs: Web server access logs showing POST requests to theme upload endpoints followed by GET requests to .php files in upload directories; unusual user-agent strings in upload requests; access log entries for PHP files in directories that should only contain media.
• Process: Unexpected child processes spawned by the web server (e.g., php, bash, curl, wget) executing system commands; unusual cron jobs or scheduled tasks added under the web server user account (Patchstack).

The primary remediation is to update the Corpkit WordPress theme to version 2.0.1 or later, which contains the fix for this vulnerability (Patchstack). Patchstack has also issued a virtual patch (WAF rule) that blocks exploitation attempts for users of its service until the theme is updated. If an immediate update is not possible, administrators should restrict file upload functionality, implement whitelist-based file type validation at the server level, disable PHP execution in upload directories (e.g., via .htaccess), and monitor upload activity for suspicious patterns.

Wordfence included this vulnerability in its weekly WordPress vulnerability report for January 5–11, 2026, highlighting it as part of a broader set of WordPress theme and plugin issues disclosed that week (Wordfence Blog). The Hacker Wire also published a brief article covering the web shell upload risk posed by CVE-2025-67924 in the Corpkit theme (The Hacker Wire). No significant vendor statements beyond Patchstack's advisory have been identified.