Stockholm Core CVE-2025-68067
HIGHSeverity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
High AC due to path crafting complexity; LFI can escalate to code execution, justifying full I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm-core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through <= 2.4.6.
AnalysisAI
Local file inclusion in the Stockholm Core WordPress plugin (≤2.4.6) allows authenticated users with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation or public exploit code is known at this time, though the low EPSS score indicates limited real-world risk despite the high CVSS impact.
Technical ContextAI
The vulnerability is a PHP local file inclusion (LFI) in the Stockholm Core plugin, a companion to a premium WordPress theme. Improper sanitisation of user input for include/require statements (CWE-98) allows an attacker to traverse the file system and read arbitrary local files. In PHP, LFI may be chained with log file poisoning or other techniques to achieve code execution within the WordPress context. The attack surface is limited to authenticated sessions, and the plugin operates within the WordPress ecosystem.
Affected ProductsAI
Stockholm Core WordPress plugin version 2.4.6 and all prior versions. The advisory from Patchstack (https://patchstack.com/database/Wordpress/Plugin/stockholm-core/vulnerability/wordpress-stockholm-core-plugin-2-4-6-local-file-inclusion-vulnerability?_s_id=cve) is the primary source of affected version information. No CPE data was provided in the input.
RemediationAI
No patched version is confirmed in the available data; refer to the Patchstack advisory or the plugin developer’s channels for updates. As an immediate workaround, disable the Stockholm Core plugin if it is not essential to site operation-note that this may break theme functionality. Limit low-privileged user accounts to trusted individuals, and monitor web server logs for unusual file access patterns. For critical sites, consider deploying a Web Application Firewall rule to block suspicious path traversal attempts targeting the plugin’s endpoints.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-98 – PHP Remote File Inclusion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today