What is the CVSS score of CVE-2025-68987?

CVE-2025-68987 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-68987?

CVE-2025-68987 is a critical file inclusion vulnerability in Edge-Themes Cinerama WordPress theme (versions ≤2.9) that allows unauthenticated attackers to read arbitrary files from affected servers,…

How to fix or mitigate CVE-2025-68987?

Within 24 hours: Audit all WordPress installations for Edge-Themes Cinerama theme presence and version (check wp-content/themes/ directory). Within 7 days: If theme is installed and version ≤2.9, immediately deactivate and remove the theme; replace with a patched alternative or verified secure theme. Within 30 days: Implement file integrity monitoring on wp-config.php and other sensitive files; review web server access logs for suspicious file inclusion attempts; rotate any exposed credentials.

PHP CVE-2025-68987

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-30 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 30, 2025 - 11:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows PHP Local File Inclusion.This issue affects Cinerama: from n/a through <= 2.9.

AnalysisAI

Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98), commonly known as Local File Inclusion (LFI). Despite the CVE title mentioning Remote File Inclusion (RFI), the tags and Patchstack reference confirm this is an LFI vulnerability in the Cinerama WordPress theme. LFI occurs when user-supplied input is insufficiently sanitized before being passed to PHP file inclusion functions like include(), require(), or their variants. Attackers exploit this by manipulating file path parameters with directory traversal sequences (../) or absolute paths to access files outside the intended directory structure. The Edge-Themes Cinerama theme, designed for movie studios and filmmakers, contains vulnerable code that allows attackers to specify arbitrary file paths for inclusion, potentially exposing WordPress configuration files (wp-config.php), server logs, SSH keys, database credentials, and other sensitive system files through HTTP requests.

Affected ProductsAI

The vulnerability affects Edge-Themes Cinerama WordPress theme versions from an unspecified initial release through version 2.9 and earlier. Cinerama is a commercial WordPress theme marketed for movie studios, filmmakers, and entertainment industry websites. All installations running version 2.9 or below are vulnerable to unauthenticated local file inclusion attacks. The vendor advisory and detailed vulnerability information are available through Patchstack at https://patchstack.com/database/Wordpress/Theme/cinerama/vulnerability/wordpress-cinerama-a-wordpress-theme-for-movie-studios-and-filmmakers-theme-2-4-local-file-inclusion-vulnerability.

RemediationAI

Organizations using Edge-Themes Cinerama theme should immediately verify their installed version through the WordPress admin dashboard under Appearance > Themes. If running version 2.9 or earlier, upgrade to the latest version available from Edge-Themes or through ThemeForest. Patch availability from the vendor has not been independently confirmed from the provided data sources, so administrators should contact Edge-Themes support directly or check their ThemeForest purchase dashboard for available updates. As an interim mitigation measure, consider temporarily switching to a different WordPress theme until a patched version can be confirmed and deployed. Implement web application firewall (WAF) rules to detect and block directory traversal patterns in HTTP requests targeting theme files. Review server logs for suspicious requests containing patterns like ../ or absolute file paths in theme-related parameters. Ensure proper file permissions are set on sensitive configuration files to limit exposure even if LFI exploitation is attempted. Detailed vulnerability information and updates can be monitored through the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/cinerama/vulnerability/wordpress-cinerama-a-wordpress-theme-for-movie-studios-and-filmmakers-theme-2-4-local-file-inclusion-vulnerability.