What is the CVSS score of CVE-2025-68546?

CVE-2025-68546 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Nika WordPress Theme are affected by CVE-2025-68546?

CVE-2025-68546 affects the Nika WordPress theme (up to version 1.2.14) and permits authenticated users with low privileges to access arbitrary files on web servers through inadequate input…

How to fix or mitigate CVE-2025-68546?

Within 24 hours: Identify all WordPress installations using Nika theme version 1.2.14 or earlier via plugin scanner or hosting control panel audit. Within 7 days: disable or remove the Nika theme; migrate to an actively maintained alternative and apply WordPress core/plugin updates. Within 30 days: implement web application firewall rules to block suspicious file include patterns; enforce role-based access control limiting low-privilege user count; review access logs for unauthorized file read attempts.

Nika WordPress Theme CVE-2025-68546

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-23 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:13 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 23, 2025 - 12:15 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through <= 1.2.14.

AnalysisAI

Local File Inclusion in Nika WordPress theme through version 1.2.14 allows authenticated attackers with low-level privileges to read arbitrary files on the server via improper filename validation in PHP include/require statements. EPSS score of 0.17% (38th percentile) indicates low predicted exploitation probability. No public exploit code or active exploitation confirmed at time of analysis, though Patchstack's disclosure suggests vulnerability details are documented.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a classic PHP security flaw where user-controlled input influences file path parameters in include(), require(), or similar constructs without proper sanitization. Despite the CVE description title mentioning 'PHP Remote File Inclusion,' the vulnerability is confirmed as Local File Inclusion per Patchstack tags and CVSS scope (S:U). The affected product is Nika, a WordPress theme by thembay vendor, versions up to and including 1.2.14. LFI vulnerabilities in WordPress themes typically occur when theme options, AJAX handlers, or template routing mechanisms accept filename parameters without validating against directory traversal sequences (../) or restricting to allowed file sets. In WordPress environments, successful LFI can expose wp-config.php credentials, /etc/passwd on Linux hosts, or other sensitive configuration files.

Affected ProductsAI

WordPress Nika theme by thembay vendor, versions from earliest available release through version 1.2.14 inclusive. The vulnerability affects all installations where authenticated users with low-level privileges (Subscriber role or higher in WordPress) can interact with the vulnerable file inclusion mechanism. Patchstack advisory available at https://patchstack.com/database/Wordpress/Theme/nika/vulnerability/wordpress-nika-theme-1-2-14-local-file-inclusion-vulnerability provides detailed vulnerability information.

RemediationAI

Update Nika theme to version 1.2.15 or later if available, verifying fix through vendor release notes-patch version not independently confirmed from available data sources. If patched version is unavailable or upgrade is delayed, implement these compensating controls with noted trade-offs: (1) Remove or restrict low-privilege authenticated user accounts (Subscriber/Contributor roles) to minimize attack surface, though this may impact site functionality requiring user registration. (2) Configure PHP open_basedir directive to restrict file access to WordPress installation directory and uploads, preventing traversal to system files-test thoroughly as overly restrictive settings can break legitimate theme/plugin functionality. (3) Implement Web Application Firewall rules to detect and block directory traversal patterns (../, %2e%2e%2f, etc.) in requests to theme files, noting this may cause false positives with legitimate encoded URLs. (4) Enable WordPress file integrity monitoring to detect unauthorized access to wp-config.php and other sensitive files. Monitor WordPress access logs for unusual file parameter patterns. Consult Patchstack advisory for vendor-specific guidance: https://patchstack.com/database/Wordpress/Theme/nika/vulnerability/wordpress-nika-theme-1-2-14-local-file-inclusion-vulnerability.