What is the CVSS score of CVE-2025-68063?

CVE-2025-68063 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Splash Theme are affected by CVE-2025-68063?

A Local File Inclusion vulnerability in Splash - Sport Club WordPress theme (versions 4.4.3 and earlier) allows authenticated contributors to read arbitrary server files and potentially execute code,…

How to fix or mitigate CVE-2025-68063?

24 hours: Inventory WordPress installations using Splash theme; audit Contributor-level user accounts and disable inactive accounts. 7 days: Either remove the Splash theme and migrate to a patched alternative (e.g., OceanWP, Neve) OR restrict Contributor role permissions to exclude file-upload capabilities via role editor plugins. 30 days: Monitor Splash theme vendor (likely Patchstack source) for patch release; establish a change control process for WordPress theme updates.

Splash Theme CVE-2025-68063

EUVD-2025-210358 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-26 audit@patchstack.com

GHSA-857g-g865-4j3m

WordPress LFI Information Disclosure PHP

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-reachable include sink (AV:N) needing a Contributor account (PR:L) and non-trivial conditions to land (AC:H); PHP include enables file read plus potential code execution, so C/I/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:31 vuln.today

CVE Published

Jun 26, 2026 - 15:16 cve.org

HIGH 7.5

DescriptionCVE.org

Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

Articles & Coverage 2

News 8 New PHP Vulnerabilities - 2 Critical, 6 High, 1 With POC Jun 27, 2026 News 11 New WordPress Vulnerabilities - 1 Critical, 10 High, 2 With POC Jun 27, 2026

AnalysisAI

Local File Inclusion in the Splash - Sport Club WordPress theme (versions 4.4.3 and earlier) lets an authenticated Contributor-level user supply a controlled filename to a PHP include/require sink, exposing local server files and potentially escalating to code execution. The flaw was reported by Patchstack and carries a CVSS 7.5; no public exploit identified at time of analysis, and it is not listed in CISA KEV. Exploitation requires an existing low-privilege account and overcomes elevated attack complexity, narrowing realistic abuse to multi-author sites.

Technical ContextAI

Splash is a commercial WordPress theme aimed at sports clubs (basketball, football, hockey). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement), where user-influenced input reaches a PHP include()/require() call without adequate sanitization or allow-listing. In WordPress themes this typically occurs when a template-loading, AJAX, or widget parameter is passed straight into an include path, allowing path traversal to arbitrary local files. Because the sink is a PHP include rather than a raw file-read, included content that contains PHP can be executed, which is why include-based LFI is frequently a stepping stone to remote code execution rather than pure disclosure.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to upgrade to a release later than 4.4.3 once the theme author publishes a fixed build, and to monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/splash/vulnerability/wordpress-splash-sport-club-wordpress-theme-for-basketball-football-hockey-theme-4-4-3-local-file-inclusion-vulnerability?_s_id=cve) for the patched version. As compensating controls until a patch is applied: tighten role assignments so untrusted users are not granted Contributor or higher (removing the PR:L precondition entirely, at the cost of limiting collaborative authoring); deploy a WordPress WAF (such as Patchstack's virtual patch) to filter path-traversal and include parameters reaching the theme, accepting possible false positives on legitimate template requests; and harden PHP with open_basedir and allow_url_include=Off to constrain which files can be included, which may break plugins relying on broad filesystem access. Audit existing Contributor accounts for signs of abuse before remediating.