CVE-2025-67982: 
WordPress vulnerability analysis and mitigation

CVE-2025-67982 is a PHP Local File Inclusion (LFI) vulnerability in the Urna WordPress theme developed by thembay. It stems from improper control of filename for include/require statements (CWE-98), allowing unauthenticated remote attackers to include and execute arbitrary local files on the server. All versions of the Urna theme up to and including 2.5.12 are affected. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Red Hat CVE).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which is commonly associated with PHP Remote File Inclusion but in this case manifests as Local File Inclusion. The flaw arises when user-supplied input is passed without adequate sanitization into PHP include or require statements within the Urna theme, enabling an attacker to manipulate the file path to reference arbitrary local files on the server. Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting specific conditions or non-default configurations must be met. No public proof-of-concept code has been identified at this time (Red Hat CVE).

Successful exploitation of this vulnerability could allow an attacker to read sensitive local files such as configuration files containing database credentials or API keys, execute arbitrary PHP code if writable files or upload directories are accessible, and potentially achieve full server compromise. The CVSS scoring reflects High impacts across confidentiality, integrity, and availability, indicating that all three security pillars are at risk. Lateral movement within the hosting environment or pivoting to other hosted applications on the same server is a realistic post-exploitation scenario (Red Hat CVE).

There is currently no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed. The EPSS score is approximately 0.053%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The High attack complexity rating suggests that exploitation is not trivial and may require specific environmental conditions to be met (Red Hat CVE).

No official patch from thembay has been confirmed as available at this time. Users running Urna version 2.5.12 or earlier should immediately audit their installations and consider the following interim measures:

• Disable or replace the theme until a patched version is released by the vendor.
• Implement strict input validation on any user-supplied parameters used in file path operations.
• Deploy a Web Application Firewall (WAF) configured to detect and block local file inclusion patterns (e.g., ../, %2e%2e%2f, /etc/passwd).
• Monitor file access logs for unusual access patterns targeting sensitive system files.
• Contact thembay directly to inquire about patch availability and timelines (Red Hat CVE).

The vulnerability was noted in a Wordfence Intelligence weekly WordPress vulnerability report covering the period of February 2–8, 2026, indicating it received standard tracking within the WordPress security community. No significant vendor statements, notable researcher commentary, or broader media coverage has been identified beyond routine vulnerability database entries (Wordfence Blog).