Goya Core CVE-2025-68064

Exploitation requires an authenticated WordPress account at Contributor privilege level or higher (CVSS PR:L) on a site running Goya Core below 1.0.9.4; it is therefore not exploitable by fully anonymous visitors. The vulnerable code path is a PHP include/require that accepts a user-influenced file path, so the attacker must reach that specific plugin parameter/endpoint and supply a traversal or crafted local path. Limiting factors that reduce real-world risk: the requirement for a valid low-privilege account (sites that disable open registration and grant no untrusted Contributor roles are largely insulated), the high attack complexity (CVSS AC:H, indicating non-trivial preconditions on the path or parameter), and dependence on filesystem layout and PHP configuration for the inclusion to yield sensitive data or code execution. No user interaction is required (UI:N).

Signals are partially conflicting and should be weighed carefully. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) indicates network reach but high attack complexity and a required low-privilege (Contributor) account, which materially narrows the realistic attacker population to sites that permit untrusted user registration at Contributor level or higher. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS value was provided, so there is no evidence of active or imminent mass exploitation. The full C:H/I:H/A:H impact triad is somewhat aggressive for what the description frames as 'Information Disclosure / LFI' - Patchstack likely rates it high because PHP LFI can chain to code execution, but the AC:H qualifier suggests preconditions (specific path/parameter constraints) that limit reliability. Net: a real but moderate priority - patch promptly on multi-author sites, lower urgency on single-admin installations where no untrusted Contributor accounts exist.

An attacker registers or obtains a Contributor account on a WordPress site running a vulnerable Goya Core version, then sends a crafted request whose file parameter contains directory-traversal sequences to make the plugin include a sensitive local file such as wp-config.php or a poisoned log. Reading wp-config.php yields database credentials and secret keys, and if the attacker can stage PHP content into an includable path the LFI can be chained toward code execution. No public exploit is identified at time of analysis, and the CVSS AC:H rating implies the working exploit requires specific path or parameter conditions to be met.