Cyber Posture

CVE-2025-68539

High

Published: 20 February 2026

Published
20 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0006 17.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Security Summary

CVE-2025-68539 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion, in the thembay Fana WordPress theme. This flaw enables PHP Local File Inclusion and affects Fana theme versions from n/a through 1.1.35 inclusive. The vulnerability is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.

Remote unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) without requiring user interaction (UI:N), though it demands high attack complexity (AC:H). Successful exploitation allows attackers to achieve high-impact outcomes, including unauthorized access to local files via local file inclusion, with unchanged scope (S:U).

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/fana/vulnerability/wordpress-fana-theme-1-1-35-local-file-inclusion-vulnerability-2?_s_id=cve provides details on this Local File Inclusion vulnerability in the WordPress Fana theme version 1.1.35. The CVE was published on 2026-02-20T16:22:11.373.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

LFI vulnerability in public-facing WordPress theme enables exploitation of public-facing application (T1190) and facilitates unauthorized access to data from local system files (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References