CVE-2025-67920
Published: 08 January 2026
Summary
CVE-2025-67920 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-67920 by requiring timely remediation through updating the vulnerable Neo Ocular WordPress theme to version 1.2 or later.
Addresses the core issue of improper filename control in PHP include/require statements by enforcing validation of inputs to block local file inclusion exploitation.
Enables proactive identification of vulnerabilities like this PHP LFI in the Neo Ocular theme through regular scanning and monitoring.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote code execution via local file inclusion in a public-facing WordPress theme, directly enabling exploitation of a public-facing application.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File Inclusion.This issue affects Neo Ocular: from n/a through < 1.2.
Deeper analysisAI
CVE-2025-67920 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, also known as PHP Remote File Inclusion, in the Elated-Themes Neo Ocular WordPress theme (neoocular). It enables PHP Local File Inclusion and affects all versions from n/a through those prior to 1.2. The vulnerability is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (High), with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Remote unauthenticated attackers can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability, potentially enabling them to include and execute arbitrary local PHP files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/neoocular/vulnerability/wordpress-neo-ocular-theme-1-2-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability in the Neo Ocular WordPress theme, implying mitigation through updating to version 1.2 or later, as prior versions are affected.
Details
- CWE(s)