CVE-2025-67940

High

Published: 22 January 2026

Published

22 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0050 39.1th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-67940 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-67940 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the Powerlift WordPress theme developed by Mikado-Themes. The vulnerability impacts all versions of Powerlift from n/a through those prior to 3.2.1 and is associated with CWE-98.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network, though it demands high attack complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, as reflected in its CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

The Patchstack advisory details the local file inclusion vulnerability in the Powerlift WordPress theme and indicates it was addressed in version 3.2.1.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-4062

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Powerlift powerlift allows PHP Local File Inclusion.This issue affects Powerlift: from n/a through < 3.2.1.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

This is a remote/local file inclusion vulnerability in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for initial access, sensitive file access, and potential code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0