CVE-2025-67935: 
WordPress vulnerability analysis and mitigation

CVE-2025-67935 is a Local File Inclusion (LFI) vulnerability in the Mikado-Themes "Optimize" (optimizewp) WordPress theme, caused by improper control of filenames in PHP include/require statements (CWE-98). It affects all versions of the Optimize theme prior to 2.4 and was reported by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity on October 24, 2025, with public disclosure on January 6–8, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), as assessed by CISA-ADP (Patchstack, NVD).

The root cause is classified as CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program — where user-supplied input is passed to a PHP include or require statement without adequate sanitization or validation. This allows an unauthenticated attacker to manipulate the filename parameter to include arbitrary files from the local server filesystem. No authentication is required for exploitation, though the attack complexity is rated High (AC:H), suggesting some precondition or non-trivial exploitation step is involved. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to include and execute arbitrary files from the local filesystem, potentially exposing sensitive configuration files such as wp-config.php (which contains database credentials), application source code, and other confidential data. In scenarios where database credentials are exposed, this could lead to complete database takeover. The vulnerability affects confidentiality, integrity, and availability of the WordPress site, and could serve as a stepping stone for further compromise of the hosting environment (Patchstack).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires no authentication, though the High attack complexity rating suggests exploitation is non-trivial. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting WordPress sites (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the Optimize (optimizewp) theme version prior to 2.4 using tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Locate the theme's PHP include/require statement that accepts user-controlled input for the filename, typically exposed via a URL parameter or POST field.
3. Craft malicious request: Send an HTTP request with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php) to trigger the LFI.
4. Extract sensitive data: Review the server response for the contents of the included file, which may contain database credentials, secret keys, or other configuration data from wp-config.php.
5. Escalate access: Use extracted credentials to access the WordPress database directly, enabling account takeover, data exfiltration, or further lateral movement within the hosting environment (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameter values; requests returning unexpected file contents.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting theme-related PHP files; repeated 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files by the web server process; new or modified files in the theme directory.
• Process: Web server processes (e.g., Apache, Nginx, PHP-FPM) reading files outside the expected web root directory.

The primary remediation is to update the Optimize (optimizewp) WordPress theme to version 2.4 or later, which contains the fix for this vulnerability (Patchstack). Patchstack has also issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts until the theme is updated. As a general hardening measure, restrict PHP file inclusion capabilities at the server level (e.g., disable allow_url_include in php.ini) and apply the principle of least privilege to web server file access. Site owners unable to update immediately should consult their hosting provider or web developer for assistance.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for January 5–11, 2026, highlighting it as part of a broader set of WordPress theme and plugin issues (Wordfence Blog). The vulnerability was also noted on social platforms including Mastodon and Bluesky by security news accounts such as TheHackerWire. Community reaction has been moderate, consistent with typical WordPress theme LFI disclosures, with emphasis on prompt patching given the unauthenticated attack vector.