CVE-2025-67936: 
NixOS vulnerability analysis and mitigation

CVE-2025-67936 is a Local File Inclusion (LFI) vulnerability in the Mikado-Themes Curly WordPress theme, caused by improper control of filenames used in PHP include/require statements (CWE-98). It affects all versions of the Curly theme prior to 3.3, developed by Qode Interactive (Mikado-Themes). The vulnerability was reported on October 24, 2025, by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity, published by Patchstack on January 6, 2026, and received a CVSS v3.1 base score of 8.1 (High) (Patchstack, NVD).

The vulnerability stems from inadequate validation of filenames passed to PHP include or require statements within the Curly WordPress theme (CWE-98). An unauthenticated remote attacker can manipulate filename parameters to cause the server to include arbitrary local files, potentially exposing their contents or executing embedded PHP code. The attack vector is network-based with high attack complexity and requires no privileges or user interaction, per the CISA-ADP CVSS assessment. No public proof-of-concept exploit code has been identified at this time (Patchstack, NVD).

Successful exploitation could allow an attacker to read sensitive local files on the web server, including configuration files containing database credentials, WordPress wp-config.php, and other confidential data. In scenarios where the included file contains PHP code, attackers may achieve arbitrary code execution, leading to full site compromise, data theft, and potential lateral movement within the hosting environment. The vulnerability is classified under OWASP Top 10 A3: Injection and is considered highly dangerous with potential for use in mass-exploit campaigns targeting WordPress sites regardless of their size or traffic (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. However, Patchstack rates this as high priority and notes that LFI vulnerabilities of this class are frequently leveraged in mass-exploit campaigns targeting WordPress installations (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the Curly theme (versions < 3.3) via tools like WPScan, Shodan, or by inspecting page source for theme indicators such as /wp-content/themes/curly/.
2. Identify vulnerable parameter: Locate theme functionality that accepts a filename or path parameter passed to a PHP include/require statement — typically exposed through theme template loading or AJAX endpoints.
3. Craft malicious request: Send an HTTP request with a manipulated filename parameter (e.g., path traversal sequences like ../../../../etc/passwd or paths to known WordPress files such as wp-config.php) to the vulnerable endpoint.
4. Retrieve sensitive file contents: If successful, the server returns the contents of the targeted local file, potentially exposing database credentials, API keys, or other sensitive configuration data.
5. Escalate if possible: If the included file contains PHP code (e.g., a previously uploaded file), the server may execute it, enabling remote code execution and further compromise (Patchstack).

• Network: Unusual HTTP GET or POST requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f) or references to sensitive files (wp-config.php, /etc/passwd) in parameter values.
• Logs: Web server access logs showing requests to Curly theme files with unexpected filename parameters; PHP error logs indicating failed file inclusion attempts or unexpected file reads.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other configuration files; presence of newly created PHP files in writable directories that could be used for code execution.
• Process: Unusual PHP child processes spawned by the web server process; unexpected outbound network connections from the web server following theme file requests.

The primary remediation is to update the Curly WordPress theme to version 3.3 or later, which contains the fix for this vulnerability (Patchstack). Patchstack has also issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts until the theme is updated. As additional hardening measures, implement strict input validation and a whitelist approach for any filename parameters used in include/require operations, enforce proper file permissions on the server, and monitor web server logs for path traversal patterns.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for January 5–11, 2026, highlighting it among notable disclosures for that period (Wordfence Blog). The vulnerability was also noted on social platforms including Bluesky and Mastodon by security news aggregators such as The Hacker Wire. No significant vendor statements beyond the Patchstack advisory have been identified.