What is the CVSS score of CVE-2025-68544?

CVE-2025-68544 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Diza WordPress Theme are affected by CVE-2025-68544?

The Diza WordPress theme versions 1.3.15 and earlier contain a local file inclusion vulnerability that allows authenticated users to access arbitrary files on affected servers, creating risk of data…

How to fix or mitigate CVE-2025-68544?

Within 24 hours: Identify all WordPress installations using Diza theme ≤1.3.15 via admin dashboard or security scanner. Within 7 days: disable the Diza theme on all affected sites, switch to an alternative theme, and review user access logs for suspicious file inclusion patterns. Within 30 days: monitor Patchstack and Diza theme official channels for security updates; once a patched version is released, test thoroughly in staging and deploy to production.

Diza WordPress Theme CVE-2025-68544

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-23 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:14 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 23, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.

AnalysisAI

Local File Inclusion (LFI) vulnerability in the Diza WordPress theme (≤1.3.15) enables low-privileged authenticated attackers to include arbitrary local files, potentially leading to remote code execution, sensitive data exposure, or complete site compromise. The CVSS score of 7.5 reflects high complexity network-based attack requiring authentication. EPSS exploitation probability is low (0.17%, 38th percentile), with no confirmed active exploitation or public proof-of-concept at time of analysis, though the vulnerability has been cataloged by Patchstack's security research team.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). Despite being classified as 'PHP Remote File Inclusion' in the description, tags and technical analysis confirm this is actually Local File Inclusion (LFI). The flaw occurs when the Diza theme improperly sanitizes user-supplied input used in PHP include() or require() statements, allowing authenticated users to manipulate file paths to include arbitrary local files from the web server. In WordPress themes, this commonly manifests in template loading mechanisms, AJAX handlers, or dynamic content inclusion features where file paths are constructed from user input without proper validation. Affected product per NVD CPE would be the Diza WordPress theme by thembay vendor, versions up to and including 1.3.15.

Affected ProductsAI

The vulnerability affects the Diza WordPress theme by thembay, all versions from earliest release through version 1.3.15. The vendor-specific product identifier is 'diza' in the WordPress theme repository. According to the Patchstack vulnerability database reference at https://patchstack.com/database/Wordpress/Theme/diza/vulnerability/wordpress-diza-theme-1-3-15-local-file-inclusion-vulnerability, sites running any version in this range on standard WordPress installations are vulnerable. No platform-specific limitations are indicated, suggesting the flaw affects all hosting environments running PHP-based WordPress deployments.

RemediationAI

Update the Diza theme to version 1.3.16 or later if available, as the vulnerability affects versions through 1.3.15, indicating a fix should be released in subsequent versions. Contact thembay directly or check the theme's official distribution channel for the patched release. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/diza/vulnerability/wordpress-diza-theme-1-3-15-local-file-inclusion-vulnerability for vendor-confirmed fix details. If immediate patching is not possible, implement these compensating controls: restrict WordPress user registration to prevent unauthorized account creation (Settings → General → Membership), audit and remove unnecessary low-privilege user accounts, implement Web Application Firewall (WAF) rules to detect file inclusion patterns in HTTP parameters (regex matching '../' traversal sequences, absolute paths, or sensitive filenames like 'wp-config'), and enable PHP open_basedir restrictions to limit file system access scope. Note that WAF rules may cause false positives with legitimate theme functionality and open_basedir can break plugins expecting unrestricted file access. These mitigations reduce attack surface but do not eliminate the underlying vulnerability.