CVE-2025-68901: 
WordPress vulnerability analysis and mitigation

CVE-2025-68901 is a Path Traversal vulnerability (CWE-22) in the AivahThemes Anona WordPress theme that allows unauthenticated attackers to perform arbitrary file deletion via filesystem traversal. It affects all versions of the Anona theme through version 8.0, with no official patch currently available. The vulnerability was reported on September 11, 2025, and publicly disclosed by Patchstack on January 13–22, 2026. The CNA (Patchstack) assigned a CVSS v3.1 base score of 8.6 (High), while an earlier CISA-ADP score also rated it 8.6 (High) (Patchstack, NVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and enables arbitrary file deletion through insufficient validation of user-supplied file path inputs within the Anona WordPress theme. An unauthenticated remote attacker can craft malicious HTTP requests containing path traversal sequences (e.g., ../) to escape the intended directory boundary and reference arbitrary files on the server. No authentication or user interaction is required, and the attack complexity is low, making it trivially exploitable over the network. The vulnerability was discovered by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity and reported to Patchstack on September 11, 2025 (Patchstack, NVD).

Successful exploitation allows an unauthenticated attacker to delete arbitrary files on the web server hosting the vulnerable WordPress theme. Deletion of WordPress core files, configuration files (e.g., wp-config.php), or other critical assets can cause the website to become fully non-functional, resulting in a high availability impact. While the primary impact is file deletion (integrity and availability), the path traversal mechanism could also expose sensitive file paths and server structure information, and deletion of security-relevant files could facilitate further compromise or lateral movement (Patchstack).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires no authentication and no user interaction, which significantly lowers the barrier for exploitation and increases the risk of mass-exploit campaigns targeting WordPress sites. The EPSS score is approximately 0.021% (0.000210), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no specific threat actor attribution has been reported (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites using the Anona theme (version ≤ 8.0) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting HTTP response headers and page source for theme indicators.
2. Identify vulnerable endpoint: Locate the theme functionality that accepts file path parameters — typically a file management or download/delete handler within the theme's PHP code.
3. Craft path traversal payload: Construct an HTTP request containing path traversal sequences (e.g., ../../wp-config.php or ../../wp-includes/functions.php) in the relevant parameter to escape the theme's intended directory.
4. Send unauthenticated request: Submit the crafted request directly to the target WordPress site without any authentication credentials or session tokens.
5. Achieve arbitrary file deletion: If the server processes the traversal path without sanitization, the targeted file is deleted — potentially disabling the site (by removing core files) or removing security controls (Patchstack).

• Network: Unusual HTTP POST or GET requests to Anona theme endpoints containing path traversal sequences such as ../, %2e%2e%2f, or ..%2f in file path parameters; requests from unexpected or automated IP addresses targeting theme-specific URLs.
• Logs: WordPress or web server access logs showing requests with encoded or literal ../ sequences in query strings or POST bodies directed at theme PHP files; HTTP 200 responses to requests referencing files outside the theme directory.
• File System: Unexpected disappearance of WordPress core files (e.g., wp-config.php, wp-login.php, files in wp-includes/ or wp-admin/); missing theme or plugin files not explained by legitimate updates.
• Application Behavior: WordPress site suddenly returning errors, white screens, or failing to load — potentially indicating deletion of critical core files (Patchstack).

No official patch from AivahThemes is currently available for the Anona theme. Patchstack has issued a virtual patching/mitigation rule for Patchstack-protected sites to block exploitation attempts until an official fix is released. Administrators should consider the following immediate actions:

• Remove or replace the theme if it is not essential, or temporarily switch to a different theme.
• Implement a Web Application Firewall (WAF) with rules to detect and block path traversal patterns (e.g., ../, URL-encoded variants).
• Apply principle of least privilege to web server file system permissions to limit the impact of any file deletion.
• Monitor server logs for suspicious requests containing traversal sequences targeting theme endpoints.
• Subscribe to Patchstack for virtual patch coverage until an official vendor fix is available (Patchstack).

Wordfence included CVE-2025-68901 in its weekly WordPress vulnerability report for the week of January 12–18, 2026, highlighting it as part of broader WordPress ecosystem security coverage (Wordfence). Patchstack, the discovering and reporting organization, classified it as high priority and noted the potential for mass-exploit campaigns given the unauthenticated nature of the flaw. No significant broader media coverage or notable researcher commentary beyond these standard vulnerability disclosure channels has been identified.