CVE-2025-68983
Published: 30 December 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-68983 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, in the thembay Greenmart WordPress theme. This flaw affects Greenmart versions from n/a through 4.2.11 and is associated with CWE-98.
Attackers with low privileges, such as authenticated low-privileged users, can exploit this vulnerability over the network (AV:N) with high attack complexity (AC:H) and no user interaction required (UI:N). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within unchanged scope (S:U), yielding a CVSS v3.1 base score of 7.5.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/greenmart/vulnerability/wordpress-greenmart-theme-4-2-11-local-file-inclusion-vulnerability?_s_id=cve details this Local File Inclusion issue in Greenmart version 4.2.11 and serves as the primary reference for mitigation strategies and patches.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a public-facing PHP Remote/Local File Inclusion in a WordPress theme, enabling unauthenticated remote code execution or file disclosure, directly mapping to T1190: Exploit Public-Facing Application.