Cyber Posture

CVE-2025-68545

High

Published: 20 February 2026

Published
20 February 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly addresses the improper filename control in PHP include/require by requiring validation of user-supplied inputs to prevent LFI exploitation.

SI-2 Flaw Remediation good match
prevent

Mandates timely flaw remediation, such as patching the vulnerable Nika WordPress theme versions up to 1.2.14, to eliminate the LFI vulnerability.

CM-6 Configuration Settings partial match
prevent

Enforces secure configuration settings like PHP open_basedir restrictions or disabling allow_url_include to limit file access in LFI scenarios.

Security SummaryAI

CVE-2025-68545 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (LFI), affecting the Nika WordPress theme by thembay. This flaw impacts Nika versions from n/a through 1.2.14 and is associated with CWE-98. The vulnerability was published on 2026-02-20 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation grants high-impact access to local files on the server, potentially compromising confidentiality by reading sensitive data, integrity by modifying included files, and availability through disruption, enabling severe server-side compromise.

Patchstack has documented this Local File Inclusion vulnerability specifically in WordPress Nika theme version 1.2.14, with details available at https://patchstack.com/database/Wordpress/Theme/nika/vulnerability/wordpress-nika-theme-1-2-14-local-file-inclusion-vulnerability-2?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
T1083 File and Directory Discovery Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
attack.mitre.org →
Why these techniques?

Public-facing LFI vulnerability in WordPress theme exploited via T1190 enables arbitrary local file reads (T1005, T1083) for data collection and discovery.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References