CVE-2025-68555: 
WordPress vulnerability analysis and mitigation

CVE-2025-68555 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Nutrie WordPress theme developed by zozothemes, which allows low-privileged attackers to upload web shells to the web server. All versions of the Nutrie theme prior to 2.0.1 are affected. The vulnerability was published on March 5, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 9.9 (Critical) (Red Hat CVE, Feedly).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), meaning the Nutrie theme fails to properly validate or restrict the types of files that authenticated users can upload. An attacker with low privileges can craft a malicious file upload request over the network — without requiring user interaction — to place a web shell (e.g., a PHP script) in a web-accessible directory on the server. The changed scope (S:C) in the CVSS vector indicates that a successful exploit can impact resources beyond the vulnerable component itself, such as the underlying operating system or other hosted applications (Red Hat CVE, Wordfence).

Successful exploitation allows a low-privileged attacker to upload and execute arbitrary code on the web server via a deployed web shell, resulting in complete compromise of confidentiality, integrity, and availability. An attacker can exfiltrate sensitive data, modify or delete site content, pivot to other systems on the same network, and disrupt service availability. The changed scope means the impact extends beyond the WordPress application to the underlying server environment (Red Hat CVE, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit code and no confirmed evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported. The vulnerability is detectable via Qualys scanner (detection ID 531054) (Qualys).

1. Reconnaissance: Identify WordPress sites using the Nutrie theme (versions < 2.0.1) via passive fingerprinting tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source (/wp-content/themes/nutrie/style.css).
2. Obtain low-privileged access: Register or log in as a low-privileged WordPress user (e.g., Subscriber or Contributor role) on the target site.
3. Identify the vulnerable upload endpoint: Locate the file upload functionality exposed by the Nutrie theme that lacks proper file type validation.
4. Craft malicious payload: Prepare a PHP web shell file (e.g., shell.php) containing code such as <?php system($_GET['cmd']); ?>.
5. Upload the web shell: Submit the malicious file through the vulnerable upload endpoint, bypassing any client-side restrictions.
6. Locate the uploaded file: Determine the web-accessible path of the uploaded file (typically within /wp-content/uploads/ or a theme-specific directory).
7. Execute commands: Access the web shell via browser or curl (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to execute arbitrary OS commands and achieve full server compromise (Feedly, Wordfence).

• Network: Unusual HTTP POST requests to WordPress upload endpoints (e.g., /wp-admin/admin-ajax.php or theme-specific upload URLs) containing .php, .phtml, or other executable file extensions; subsequent GET requests to newly created files in /wp-content/uploads/ or theme directories with query parameters like cmd or exec.
• File System: Unexpected PHP files (e.g., shell.php, c99.php, r57.php) appearing in /wp-content/uploads/ or /wp-content/themes/nutrie/ directories; files with recent modification timestamps inconsistent with normal site activity.
• Logs: Web server access logs showing POST requests to upload endpoints from low-privileged authenticated sessions, followed by GET requests to the same uploaded file path; error logs showing PHP execution from upload directories.
• Process: Unusual child processes spawned by the web server process (e.g., Apache/Nginx spawning bash, curl, wget, or python) indicating web shell command execution (Feedly).

The vendor (zozothemes) has released Nutrie version 2.0.1, which patches this vulnerability. All users of the Nutrie WordPress theme should immediately upgrade to version 2.0.1 or later. As interim mitigations, administrators should implement server-level controls to prevent PHP execution in upload directories (e.g., via .htaccess rules), enforce strict file type whitelisting and magic number validation at the server level, and restrict upload functionality to only trusted user roles. Storing uploaded files outside the web root where possible is also recommended (Feedly, Wordfence).

Wordfence included CVE-2025-68555 in its weekly WordPress vulnerability report for the week of March 2–8, 2026, highlighting it as a notable critical finding (Wordfence). The Hacker Wire published a brief article covering the vulnerability shortly after disclosure (The Hacker Wire). Qualys added detection for the vulnerability (ID 531054) in its March 2026 application security detections update (Qualys). Overall community reaction has been moderate, consistent with a theme-level WordPress vulnerability without confirmed active exploitation.