CVE-2025-68908: 
WordPress vulnerability analysis and mitigation

CVE-2025-68908 is a PHP Local File Inclusion (LFI) vulnerability in the Barberry WordPress theme by temash, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Barberry theme up to and including 2.9.9.87. The vulnerability was discovered by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on September 16, 2025, and published on January 12, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack, Feedly).

The root cause is improper control of filename parameters used in PHP include/require statements (CWE-98), which allows user-supplied input to influence which local files are included and executed by the server. An unauthenticated remote attacker can craft a malicious HTTP request that manipulates the file path parameter to include arbitrary local files from the server's filesystem. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition or constraint must be met (e.g., specific server configuration or path traversal bypass). No public proof-of-concept code has been identified at this time (Patchstack, Feedly).

Successful exploitation allows an attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive files such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database takeover. The vulnerability impacts confidentiality, integrity, and availability — all rated High — meaning attackers could read sensitive data, modify application behavior, or disrupt service. Given the unauthenticated nature of the attack, mass exploitation campaigns targeting WordPress sites running the vulnerable theme are a realistic risk (Patchstack).

There is currently no public proof-of-concept exploit and no confirmed in-the-wild exploitation reported for CVE-2025-68908. The EPSS score is approximately 0.0015 (0.15%), indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, Patchstack).

No official patch from the theme developer is currently available for Barberry versions up to and including 2.9.9.87. Patchstack has issued a virtual patching/mitigation rule to block exploitation attempts for users of its service. Recommended actions include:

• Upgrade: Monitor the Barberry theme repository for a patched release and apply it immediately when available.
• Virtual Patching: Use Patchstack or a similar WAF solution to block LFI attack patterns targeting this theme.
• PHP Hardening: Disable allow_url_include in php.ini if not required, and implement strict input validation and whitelisting for file inclusion parameters.
• Least Privilege: Restrict web server file system access to limit the files that could be exposed via LFI.
• Consider Replacement: If no patch is forthcoming, consider replacing the Barberry theme with a supported alternative (Patchstack, Feedly).

Wordfence included CVE-2025-68908 in its weekly WordPress vulnerability report for the period of January 12–18, 2026, highlighting it as part of broader WordPress ecosystem security coverage. Patchstack, which coordinated the disclosure, rated it high priority and noted that vulnerabilities of this class are commonly used in mass-exploit campaigns against WordPress sites. No significant independent researcher commentary or broader media coverage has been identified beyond these security vendor reports (Wordfence, Patchstack).