CVE-2025-68506: 
WordPress vulnerability analysis and mitigation

CVE-2025-68506 is a PHP Local File Inclusion (LFI) vulnerability in the Nawawi Jamili Docket Cache WordPress plugin, classified under CWE-98 (Improper Control of Filename for Include/Require Statement). It affects all versions of the plugin up to and including 24.07.03, and was publicly disclosed on December 24, 2025, after being reported by researcher Nguyen Xuan Chien on August 16, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), exploitable by unauthenticated remote attackers with high attack complexity (Patchstack, Red Hat CVE).

The root cause is improper control of filename parameters used in PHP include/require statements within the Docket Cache plugin (CWE-98), which allows an attacker to manipulate the file path supplied to these statements. Because no authentication is required and the plugin fails to adequately validate or sanitize user-supplied input before using it in file inclusion logic, a remote attacker can craft a request that causes the server to include arbitrary local files. This falls under OWASP Top 10 category A3: Injection and is mapped to CAPEC-193 (PHP Remote File Inclusion). No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated attacker to read arbitrary local files on the web server, potentially exposing sensitive data such as database credentials (e.g., wp-config.php), configuration files, and other confidential system information. Depending on server configuration, this could escalate to remote code execution if an attacker can include a file containing PHP code (e.g., via log poisoning or uploaded files). A full database takeover or complete web application compromise is possible in worst-case scenarios (Patchstack).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been observed as of the time of disclosure. The EPSS score is approximately 0.15%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack has noted that vulnerabilities of this class and severity are frequently used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Docket Cache plugin version ≤ 24.07.03 using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/docket-cache/readme.txt.
2. Identify vulnerable endpoint: Locate the specific plugin endpoint or parameter that passes user-controlled input to a PHP include/require statement without proper sanitization.
3. Craft malicious request: Send an HTTP request with a manipulated file path parameter (e.g., path traversal sequences like ../../../../../../etc/passwd) targeting the vulnerable inclusion point.
4. Read sensitive files: If successful, the server returns the contents of the requested local file (e.g., /etc/passwd, wp-config.php) in the HTTP response, exposing credentials or other sensitive data.
5. Escalate (optional): If the server allows inclusion of attacker-controlled content (e.g., via log poisoning or a previously uploaded file containing PHP code), escalate to remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to Docket Cache plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameters; requests returning unexpected file content in responses.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting plugin URLs; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server configuration files by the web server process; new or modified PHP files in the plugin directory.
• Process: PHP process reading files outside the WordPress web root, particularly system files or credential stores.

The vulnerability is patched in Docket Cache version 24.07.04; all users should update immediately (Patchstack). Patchstack has also issued a virtual patching/mitigation rule for its users to block exploitation attempts until the plugin is updated. Additional hardening measures include implementing strict input validation for file inclusion parameters, using allow-lists for permitted file paths, restricting web server file system permissions, and monitoring web application logs for suspicious file access patterns.

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of December 15, 2025 to January 4, 2026 (Wordfence). It was also noted by TheHackerWire on social platforms including Mastodon and Bluesky shortly after disclosure. Community reaction has been moderate, consistent with a high-severity WordPress plugin vulnerability with no active exploitation observed at time of disclosure.