MinimogWP CVE-2025-68062

Requires an authenticated low-privilege WordPress account (PR:L) on a site running the ThemeMove MinimogWP theme version ≤3.9.6; the attacker must reach a theme code path that passes attacker-controlled input into a PHP include/require statement (CWE-98). Exploitation is limited by high attack complexity (AC:H) - success depends on satisfying path, wrapper, or target-file conditions the attacker does not fully control, and on the presence of a local PHP-parseable file to convert file inclusion into code execution. No user interaction is required (UI:N), and the flaw is network-reachable (AV:N), but the authentication requirement and version constraint bound the exposed population.

The vendor CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.5) presents a network-reachable, authenticated flaw with full CIA impact but high attack complexity - the AC:H materially tempers the raw score, indicating exploitation depends on conditions the attacker cannot fully control (e.g. specific parameters, path/wrapper constraints, or file-existence requirements typical of Patchstack-reported WordPress LFIs). PR:L means an attacker must already hold a valid (even low-privilege) WordPress account, which meaningfully narrows the attacker population versus a truly unauthenticated flaw. There is no EPSS score, no SSVC decision data, no CISA KEV listing, and no public POC in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent (all point to a real-but-conditional, authenticated-only theme flaw) rather than conflicting. Note the description and CWE-98 title reference 'PHP Remote File Inclusion' but the impact statement and LFI tag both specify Local File Inclusion - the actual exploitation is local file inclusion, so the RFI framing in the CWE label should not be read as remote-URL inclusion. Net: a genuine high-severity theme vulnerability worth patching, but the authentication requirement and high complexity make it a moderate real-world priority rather than a mass-exploitation emergency.

An attacker who has obtained a low-privilege authenticated session on a WordPress site running the MinimogWP theme (≤3.9.6) supplies a crafted filename to a vulnerable theme include/require path, causing the site to include a local file. By pointing inclusion at a PHP-parseable local file (e.g. an uploaded payload, log, or session file), the attacker can escalate the local file read into PHP code execution, yielding full confidentiality, integrity, and availability impact. No public exploit code is identified at time of analysis, and the high attack complexity means the attacker must satisfy specific path/wrapper conditions to succeed.