CVE-2025-68984: 
WordPress vulnerability analysis and mitigation

CVE-2025-68984 is a Local File Inclusion (LFI) vulnerability in the Puca WordPress theme developed by thembay. It stems from improper control of filename for include/require statements in PHP (CWE-98), allowing attackers to include arbitrary local files on the server. All versions of the Puca theme up to and including 2.6.39 are affected, and no official patch was available at the time of disclosure. The vulnerability was reported on November 20, 2025, and published on December 20–30, 2025, with a CVSS v3.1 base score of 9.8 (Critical) per Feedly/NVD, though Patchstack rates it 7.5 (High) with a low priority impact assessment (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. The flaw arises when user-supplied input is passed unsanitized to a PHP include() or require() statement within the Puca theme, allowing an attacker to manipulate the file path and force the server to include arbitrary local files. Exploitation requires at least Contributor-level privileges on the WordPress site, limiting the attack surface compared to fully unauthenticated vulnerabilities (Patchstack). The vulnerability was discovered and reported by researcher João Pedro S Alcântara (Kinorth).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), potentially enabling complete database takeover. Depending on server configuration, LFI may also be chained with log poisoning or other techniques to achieve remote code execution. The confidentiality, integrity, and availability of the affected WordPress installation are all rated as high impact (Patchstack).

The EPSS score for CVE-2025-68984 is approximately 0.0015 (0.15%), indicating a low current probability of exploitation in the wild. Exploitation requires at least Contributor-level WordPress privileges, which reduces the likelihood of mass unauthenticated exploitation. No evidence of active in-the-wild exploitation, threat actor attribution, or inclusion in the CISA KEV catalog has been identified. Patchstack notes that vulnerabilities of this class are used in mass-exploit campaigns targeting thousands of WordPress sites, though this specific CVE is rated low priority (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Puca theme (version ≤ 2.6.39) via tools like WPScan, Shodan, or by inspecting theme metadata in page source (/wp-content/themes/puca/style.css).
2. Obtain Required Privileges: Gain at least Contributor-level access to the target WordPress site (e.g., via credential stuffing, phishing, or registration if open).
3. Identify Vulnerable Parameter: Locate the theme functionality that passes user-controlled input to a PHP include() or require() statement without proper sanitization.
4. Craft LFI Payload: Submit a crafted request with a path traversal payload (e.g., ../../../../wp-config.php or /etc/passwd) in the vulnerable parameter to force the server to include a sensitive local file.
5. Exfiltrate Sensitive Data: Review the server response for the contents of the included file, extracting credentials (e.g., database username/password from wp-config.php) or other sensitive information for further exploitation.

• Logs: WordPress access logs showing requests with path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in theme-related parameters; repeated HTTP requests to theme template endpoints with unusual file path values.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files by the web server process.
• Network: Outbound connections from the web server following successful LFI, potentially indicating chained exploitation (e.g., log poisoning leading to RCE).
• Process: Unusual PHP processes spawned by the web server user, or unexpected database connection attempts from new IP addresses after credential exposure.

As of the disclosure date, no official patch was available for the Puca theme from thembay. Site administrators should monitor the theme's update channel and apply any released patch immediately. In the interim, consider restricting Contributor-level user registrations, using a web application firewall (WAF) with LFI detection rules (such as Patchstack's virtual patching), or temporarily replacing the Puca theme with a patched alternative. Hosting providers or web developers should be consulted if an immediate upgrade path is unavailable (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of December 15, 2025 to January 4, 2026, indicating it received standard industry tracking. Social media mentions appeared on Infosec.exchange and Bluesky via TheHackerWire, suggesting moderate community awareness. No major vendor statements or in-depth researcher write-ups beyond the Patchstack advisory have been identified (Wordfence Blog).