CVE-2025-68841: 
WordPress vulnerability analysis and mitigation

CVE-2025-68841 is a Local File Inclusion (LFI) vulnerability in the TopperPack – Complete Elementor Addons, Theme & CPT Builder WordPress plugin by Themepul. It affects all versions up to and including 1.2.1, and was reported on November 21, 2025, with public disclosure on February 4, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Patchstack, Feedly).

The root cause is classified as CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion/Local File Inclusion). The plugin fails to properly sanitize or validate user-supplied input used in PHP include/require statements, allowing an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires network access and user interaction (e.g., a privileged user visiting a crafted page or clicking a malicious link), but no authentication is required from the attacker's side (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, exposure of secret keys, and potentially further compromise of the WordPress installation and underlying server. The confidentiality, integrity, and availability impacts are all rated High (Patchstack).

The vulnerability has an EPSS score of approximately 0.053% (0.000530), indicating a relatively low but non-negligible probability of exploitation in the near term. No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported at this time. Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity, and has issued a virtual patch/mitigation rule for its users (Patchstack). The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the TopperPack plugin (version ≤ 1.2.1) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/topper-pack/).
2. Craft malicious request: Construct a request that supplies a manipulated filename parameter to the vulnerable PHP include/require code path within the plugin, referencing a sensitive local file (e.g., ../../../../wp-config.php).
3. Trigger user interaction: Deliver the crafted URL or page to a user (e.g., via phishing or a malicious link), as the vulnerability requires user interaction for successful exploitation.
4. Extract file contents: If exploitation succeeds, the server returns the contents of the included local file, potentially exposing database credentials, secret keys, or other sensitive configuration data (Patchstack).

• Network: Unusual HTTP requests to TopperPack plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body.
• Logs: WordPress or web server access logs showing requests to plugin-related PHP files with suspicious filename parameters referencing system files (e.g., wp-config.php, /etc/passwd).
• File System: Unexpected access or read events on sensitive files such as wp-config.php originating from the web server process.
• Process: PHP error logs showing failed or successful file inclusion attempts from within the topper-pack plugin directory.

Update the TopperPack plugin to version 1.2.2 or later, which contains the fix for this vulnerability. If an immediate update is not possible, Patchstack has issued a virtual patch/mitigation rule that blocks exploitation attempts for Patchstack-protected sites. Site administrators should also review web server logs for signs of exploitation and consider restricting access to the WordPress admin area as a general hardening measure (Patchstack).

The vulnerability was discovered and reported by security researcher Skalucy on November 21, 2025, and published by Patchstack on February 4, 2026. Patchstack highlighted it in their weekly WordPress vulnerability intelligence report for the week of February 2–8, 2026, noting the high-risk nature of LFI vulnerabilities in mass-exploit campaigns (Patchstack, Wordfence Blog). No significant broader media coverage or social media discussion has been identified.