CVE-2025-68983: 
WordPress vulnerability analysis and mitigation

CVE-2025-68983 is a Local File Inclusion (LFI) vulnerability in the thembay Greenmart WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Greenmart theme up to and including 4.2.11. The vulnerability was reported on November 20, 2025, by researcher João Pedro S Alcântara (Kinorth) and published by Patchstack on December 20, 2025. The NVD assigned a CVSS v3.1 base score of 9.8 (Critical), though Patchstack's own scoring rates it at 7.5 with a low exploitation priority (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Greenmart WordPress theme (CWE-98), enabling PHP Local File Inclusion. An unauthenticated remote attacker can manipulate user-supplied input to influence which local files are included and executed by the PHP interpreter. According to Patchstack, exploitation requires at minimum Contributor-level privileges in some configurations, though the NVD CVSS vector indicates no privileges are required. The vulnerability maps to CAPEC-193 (PHP Remote File Inclusion) and OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to include and execute arbitrary local files on the web server, potentially exposing sensitive files such as WordPress configuration files (wp-config.php) containing database credentials. This could lead to complete database takeover, unauthorized access to sensitive data, content manipulation, and potential lateral movement within the hosting infrastructure. The NVD rates the confidentiality, integrity, and availability impacts all as HIGH (Patchstack).

As of the time of disclosure, no public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.0015 (0.15%), indicating a low near-term probability of exploitation. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the exploitation priority as "Low," noting it is unlikely to be exploited imminently (Patchstack).

As of the disclosure date, no official patch has been released for the Greenmart theme by thembay. Users should monitor the theme's update channel and apply any patch exceeding version 4.2.11 as soon as it becomes available. In the interim, administrators should implement Web Application Firewall (WAF) rules to detect and block LFI-style requests, restrict access to the WordPress installation at the network level where possible, and monitor application logs for suspicious file inclusion patterns. Patchstack users can leverage virtual patching to mitigate the vulnerability without a code-level fix (Patchstack).

The vulnerability received brief coverage on social media platforms including Mastodon and Bluesky via TheHackerWire, and was included in Wordfence's weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026. No significant researcher commentary or vendor statements beyond the Patchstack advisory have been identified.