Cyber Posture

CVE-2025-67968

Critical

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0002 6.6th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-67968 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the unrestricted file upload vulnerability in the Real Homes CRM plugin through timely identification, reporting, and correction via patching or disabling.

prevent

Prevents exploitation by validating the type, extension, and content of uploaded files to block dangerous malicious files.

preventdetect

Mitigates impacts of uploaded malicious files by scanning and blocking malicious code at system entry points like web upload interfaces.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1100 Web Shell Persistence
A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.
Why these techniques?

Arbitrary file upload (CWE-434) in a public-facing web plugin directly enables initial access via exploitation of the web application (T1190) and subsequent deployment/execution of web shells for RCE and persistence (T1100).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through <= 1.0.0.

Deeper analysisAI

CVE-2025-67968 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Real Homes CRM WordPress plugin (realhomes-crm) developed by InspiryThemes. This flaw allows attackers to upload malicious files and affects all versions of the plugin from n/a through 1.0.0. The vulnerability has a CVSS v3.1 base score of 9.9 (Critical), reflecting its network accessibility (AV:N), low attack complexity (AC:L), requirement for low privileges (PR:L), lack of user interaction (UI:N), and high impacts across confidentiality, integrity, availability (C:H/I:H/A:H) with changed scope (S:C).

An authenticated attacker with low privileges, such as a registered WordPress user, can exploit this vulnerability remotely over the network with minimal complexity and no user interaction required. Successful exploitation enables the upload of arbitrary malicious files, potentially leading to full server compromise, including remote code execution, data theft, modification of system files, or denial of service, given the high impact ratings across all security principles.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/realhomes-crm/vulnerability/wordpress-real-homes-crm-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve) details this as an arbitrary file upload vulnerability in Real Homes CRM version 1.0.0; security practitioners should consult it for specific mitigation guidance, such as updating to a patched version if available or disabling the plugin.

Details

CWE(s)

CVEs Like This One

CVE-2025-49387Shared CWE-434
CVE-2025-52353Shared CWE-434
CVE-2025-25790Shared CWE-434
CVE-2025-22504Shared CWE-434
CVE-2026-33717Shared CWE-434
CVE-2025-14894Shared CWE-434
CVE-2025-65783Shared CWE-434
CVE-2025-44658Shared CWE-434
CVE-2026-37748Shared CWE-434
CVE-2025-50002Shared CWE-434

References