CVE-2025-68067: 
WordPress vulnerability analysis and mitigation

CVE-2025-68067 is a Local File Inclusion (LFI) vulnerability in the Stockholm Core WordPress plugin by Select-Themes, affecting all versions up to and including 2.4.6. The flaw was discovered by João Pedro S Alcântara (Kinorth), reported on September 18, 2025, and published by Patchstack on October 18, 2025, with CVE assignment on December 16, 2025. It carries a CVSS v3.1 base score of 7.5 (High), assigned by Patchstack (Patchstack, NVD). No official patch was available at the time of initial disclosure.

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. The root cause lies in insufficient validation of user-supplied input used in PHP include or require statements within the Stockholm Core plugin, allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server. Exploitation requires at least Contributor-level privileges on the WordPress site, and attack complexity is rated High, indicating that specific conditions or configurations must be met (Patchstack, NVD).

Successful exploitation allows an authenticated attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials). This could lead to complete database takeover, credential theft, and potential full site compromise. The CVSS score reflects High impacts across confidentiality, integrity, and availability (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes the vulnerability has a "Low" priority and is unlikely to be exploited, though it warns that similar LFI vulnerabilities are used in mass-exploit campaigns targeting WordPress sites (Patchstack). Qualys has added detection for this vulnerability (Detection ID: 531012) (Qualys).

1. Reconnaissance: Identify WordPress sites running the Stockholm Core plugin (version ≤ 2.4.6) using tools like WPScan or by checking plugin metadata in publicly accessible readme.txt files.
2. Obtain Contributor Access: Gain at minimum Contributor-level access to the target WordPress site (e.g., via credential stuffing, phishing, or registration if open).
3. Identify Vulnerable Parameter: Locate the plugin functionality that passes user-controlled input to a PHP include or require statement without proper sanitization.
4. Craft LFI Payload: Submit a crafted request with a manipulated filename parameter (e.g., path traversal sequences like ../../../../wp-config.php) to trigger inclusion of a sensitive local file.
5. Exfiltrate Data: Review the server response to extract the contents of included files, such as database credentials from wp-config.php, enabling further compromise (Patchstack).

• Logs: WordPress access logs showing requests with path traversal sequences (e.g., ../, %2e%2e%2f) in parameters associated with Stockholm Core plugin endpoints; repeated requests from a single authenticated user to plugin-related URLs with unusual parameter values.
• File System: Unexpected access to sensitive files such as wp-config.php or /etc/passwd reflected in PHP error logs or server access logs.
• Network: Outbound connections from the web server following exploitation attempts, potentially indicating credential use or further lateral movement.
• Process: PHP error log entries referencing failed or successful file inclusion attempts within the Stockholm Core plugin directory.

As of the time of disclosure, no official patched version of the Stockholm Core plugin was available. Site administrators should update the plugin to any version released after 2.4.6 if a patch becomes available, or deactivate and remove the plugin until a fix is issued. As a workaround, restrict Contributor-level user registration and limit trusted user roles to reduce the attack surface. Web application firewalls (WAFs) can be configured to block path traversal patterns in HTTP requests (Patchstack).

Patchstack, the CNA that assigned and disclosed this CVE, classified the vulnerability as low priority with unlikely exploitation impact. The vulnerability was noted in automated CVE tracking feeds and security aggregators but did not generate significant community discussion or media coverage beyond standard vulnerability database entries (Patchstack).