CVE-2025-68062: 
WordPress vulnerability analysis and mitigation

CVE-2025-68062 is a Local File Inclusion (LFI) vulnerability in the ThemeMove MinimogWP WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of MinimogWP up to and including 3.9.6, and was discovered and reported by João Pedro S Alcântara (Kinorth) on November 13, 2025, with public disclosure on December 13–16, 2025. The vulnerability was assigned a CVSS v3.1 base score of 7.5 (High) by CISA-ADP (Patchstack, Feedly).

The vulnerability stems from improper validation of filenames used in PHP include/require statements within the MinimogWP theme (CWE-98), which allows an attacker to manipulate file path parameters to include arbitrary local files from the server. Exploitation requires network access and low-level privileges (e.g., Contributor or Developer role in WordPress), but no user interaction. The attack complexity is rated High, suggesting some preconditions or non-trivial steps are required to trigger the inclusion. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation of this LFI vulnerability could allow an authenticated attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to full database compromise, credential theft, and potentially further lateral movement within the hosting environment. Confidentiality, integrity, and availability are all rated as High impact (Patchstack, Feedly).

As of the disclosure date, no official patch is available for MinimogWP, and no active in-the-wild exploitation has been publicly reported. The EPSS score is approximately 0.127%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has classified this as low priority, noting it is unlikely to be exploited at scale despite the vulnerability type being associated with mass-exploit campaigns (Patchstack, Feedly).

1. Reconnaissance: Identify WordPress sites using the MinimogWP theme version 3.9.6 or earlier, using tools like WPScan or by inspecting theme metadata in publicly accessible style.css files.
2. Obtain low-privilege access: Acquire a Contributor or Developer account on the target WordPress site, either through registration (if open), credential stuffing, or social engineering.
3. Identify vulnerable parameter: Locate the theme functionality that accepts a filename or path parameter for PHP file inclusion (e.g., a template or module loader within the theme).
4. Craft malicious request: Submit a crafted HTTP request with a manipulated file path parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php) to trigger the LFI.
5. Exfiltrate data: Review the server response for the contents of the included file, extracting credentials or other sensitive information for further exploitation (Patchstack).

• Network: HTTP requests containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in theme-related parameters; unusual GET/POST requests to MinimogWP theme endpoints with file path values.
• Logs: WordPress or web server access logs showing requests with traversal patterns targeting theme files; repeated 200 responses to requests with suspicious file, template, or module parameters.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, .env, or server configuration files; no new files created (LFI reads existing files).
• Process: PHP error logs showing failed file inclusion attempts with unusual paths, which may indicate probing activity (Patchstack).

As of the disclosure date, no official patch has been released by ThemeMove for MinimogWP. Site administrators are advised to monitor the theme's update channel and apply any available patch immediately upon release. In the interim, restricting Contributor and Developer role assignments to trusted users only can reduce the attack surface. Hosting providers or web developers should be consulted if an immediate update is not feasible. Patchstack users may benefit from virtual patching protections offered by the platform (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of December 8–14, 2025, providing broader community visibility. Patchstack, which discovered and disclosed the vulnerability, classified it as low priority with limited expected exploitation impact. No significant vendor statements from ThemeMove or notable researcher commentary beyond the initial disclosure have been identified (Wordfence, Patchstack).