CVE-2025-68530: 
WordPress vulnerability analysis and mitigation

CVE-2025-68530 is a PHP Local File Inclusion (LFI) vulnerability in the Bookory WordPress theme developed by pavothemes, affecting all versions up to and including 2.2.7. The flaw stems from improper control of filename for include/require statements (CWE-98), allowing authenticated attackers with Contributor or Developer-level privileges to manipulate file inclusion mechanisms. The vulnerability was reported on December 2, 2025, by researcher João Pedro S Alcântara (Kinorth) and published on January 1, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which maps to CAPEC-193 (PHP Remote File Inclusion). The root cause is insufficient validation of user-supplied input used in PHP include or require statements within the Bookory theme, enabling an attacker to manipulate the file path parameter to reference arbitrary local files on the server. Exploitation requires network access and at least Contributor or Developer-level WordPress privileges, with high attack complexity. No public proof-of-concept exploit code has been identified at this time (Patchstack).

Successful exploitation allows an attacker to read sensitive local files on the web server, such as configuration files containing database credentials (e.g., wp-config.php), which could lead to complete database compromise. Depending on server configuration, LFI may be chained with other techniques (e.g., log poisoning) to achieve remote code execution, potentially resulting in full website takeover. Confidentiality, integrity, and availability are all rated as high impact (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the potential for mass-exploit campaign use against WordPress sites (Patchstack).

The vulnerability is patched in Bookory theme version 2.2.8. Site administrators should update the Bookory theme to version 2.2.8 or later immediately. If an immediate update is not possible, consider temporarily disabling the theme, implementing strict server-side input validation for file inclusion paths, using allow-lists for permitted file inclusions, and reviewing file system permissions to limit exposure. Monitoring server logs for unusual file access patterns is also recommended (Patchstack).

The vulnerability received brief coverage on social media platforms including Mastodon (TheHackerWire) and Bluesky shortly after disclosure in late December 2025. Wordfence included it in their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026. No significant vendor statements or notable researcher commentary beyond the Patchstack advisory have been identified.