CVE-2025-67968
Published: 22 January 2026
Summary
CVE-2025-67968 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-67968 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Real Homes CRM WordPress plugin (realhomes-crm) developed by InspiryThemes. This flaw allows attackers to upload malicious files and affects all versions of the plugin from n/a through 1.0.0. The vulnerability has a CVSS v3.1 base score of 9.9 (Critical), reflecting its network accessibility (AV:N), low attack complexity (AC:L), requirement for low privileges (PR:L), lack of user interaction (UI:N), and high impacts across confidentiality, integrity, availability (C:H/I:H/A:H) with changed scope (S:C).
An authenticated attacker with low privileges, such as a registered WordPress user, can exploit this vulnerability remotely over the network with minimal complexity and no user interaction required. Successful exploitation enables the upload of arbitrary malicious files, potentially leading to full server compromise, including remote code execution, data theft, modification of system files, or denial of service, given the high impact ratings across all security principles.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/realhomes-crm/vulnerability/wordpress-real-homes-crm-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve) details this as an arbitrary file upload vulnerability in Real Homes CRM version 1.0.0; security practitioners should consult it for specific mitigation guidance, such as updating to a patched version if available or disabling the plugin.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4038
Vulnerability details
Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through <= 1.0.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Arbitrary file upload (CWE-434) in a public-facing web plugin directly enables initial access via exploitation of the web application (T1190) and subsequent deployment/execution of web shells for RCE and persistence (T1100).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the unrestricted file upload vulnerability in the Real Homes CRM plugin through timely identification, reporting, and correction via patching or disabling.
Prevents exploitation by validating the type, extension, and content of uploaded files to block dangerous malicious files.
Mitigates impacts of uploaded malicious files by scanning and blocking malicious code at system entry points like web upload interfaces.