What is the CVSS score of CVE-2025-67989?

CVE-2025-67989 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Kerge CVE-2025-67989

Q: Which versions of Kerge are affected by CVE-2025-67989?

Server-side request forgery in LMPixels Kerge WordPress theme 4.1.3 and earlier allows unauthenticated attackers to coerce the theme into making server-side requests to arbitrary destinations.

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2025-12-16 audit@patchstack.com

WordPress SSRF Wordpress Theme

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Vulnerability over network with high complexity; no privileges or user interaction; limited impact on a different system.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:07 vuln.today

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through <= 4.1.3.

AnalysisAI

Server-side request forgery in LMPixels Kerge WordPress theme 4.1.3 and earlier allows unauthenticated attackers to coerce the theme into making server-side requests to arbitrary destinations. Successful exploitation can lead to limited information disclosure or interaction with internal services. No active exploitation or public exploit code is currently known, and the EPSS probability is very low (0.05%), suggesting a low immediate risk.

Technical ContextAI

The vulnerability resides in the Kerge premium WordPress theme developed by LMPixels, which is identified by CPE configuration matching 'kerge' for WordPress themes. The root cause is CWE-918: Server-Side Request Forgery, typically triggered when a web application improperly validates user-supplied URLs in functions that fetch remote resources. In this case, a theme component accepts and processes URLs without adequate sanitization, allowing an attacker to make the server act as a proxy for internal or external requests. The CVSS vector indicates high attack complexity, implying that exploitation may require specific conditions or intricate request crafting.

Affected ProductsAI

Kerge WordPress theme, all versions up to and including 4.1.3, is affected. The vulnerability was reported via Patchstack and is documented in their database at https://patchstack.com/database/Wordpress/Theme/kerge/vulnerability/wordpress-kerge-theme-4-1-3-server-side-request-forgery-ssrf-vulnerability?_s_id=cve. No CPE match criteria beyond the theme slug are provided.

RemediationAI

A vendor fix is likely available per the Patchstack advisory, but an exact patched version is not independently confirmed from the provided data. Users should update to the latest version of the Kerge theme from the official purchase channel. If immediate update is impossible, consider restricting outbound network requests from the web server to trusted destinations only, or disable the theme feature that accepts external URLs-such mitigations may break legitimate functionality like image imports or remote template loading. Refer to the vendor's changelog or Patchstack entry for the fixed version number.