Cyber Posture

CVE-2025-67526

High

Published: 09 December 2025

Published
09 December 2025
Modified
27 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-67526 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98), affecting the Sailing WordPress theme developed by ThimPress. The vulnerability impacts all versions of the Sailing theme prior to 4.4.6, with a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Low-privileged authenticated users (PR:L) can exploit this vulnerability over the network (AV:N) with high attack complexity (AC:H) and no user interaction required (UI:N). Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability (C:I:A:H), potentially enabling local file inclusion to read sensitive files or execute arbitrary code if local PHP files are accessible.

Patchstack advisories recommend updating the Sailing WordPress theme to version 4.4.6 or later to mitigate this local file inclusion vulnerability, as detailed in their database entry.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is an unauthenticated Local File Inclusion (LFI) in a public-facing WordPress theme, directly enabling exploitation of a public-facing application for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References