CVE-2025-67521
Published: 09 December 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-67521 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the Select-Themes Select Core WordPress plugin (select-core). This flaw affects all versions from n/a through those prior to 2.6 and is associated with CWE-98. Published on 2025-12-09, it carries a CVSS v3.1 base score of 7.5 (High), with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
The vulnerability can be exploited by low-privileged authenticated users (PR:L) with network access (AV:N), though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation allows attackers to perform local file inclusion, potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), such as unauthorized access to sensitive local files or arbitrary code execution depending on the included files.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/select-core/vulnerability/wordpress-select-core-plugin-2-6-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion vulnerability in the Select Core plugin and indicates that updating to version 2.6 addresses the issue for affected WordPress installations.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an unauthenticated remote/local file inclusion (LFI/RFI) in a public-facing WordPress plugin, enabling arbitrary file reads and potential code execution, directly mapping to exploitation of public-facing applications.