CVE-2025-67940
Published: 22 January 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through < 3.2.1.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and correction of the specific PHP local file inclusion flaw in Powerlift versions prior to 3.2.1.
Mandates validation of filenames used in PHP include/require statements to block malicious local file inclusion attempts.
Enables scanning for the known vulnerability in the Powerlift WordPress theme to facilitate timely detection and remediation.
Security SummaryAI
CVE-2025-67940 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the Powerlift WordPress theme developed by Mikado-Themes. The vulnerability impacts all versions of Powerlift from n/a through those prior to 3.2.1 and is associated with CWE-98.
Remote attackers require no privileges or user interaction to exploit this vulnerability over the network, though it demands high attack complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
The Patchstack advisory details the local file inclusion vulnerability in the Powerlift WordPress theme and indicates it was addressed in version 3.2.1.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
This is a remote/local file inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for initial access, sensitive file access, and potential code execution.