CVE-2025-67981
Published: 20 February 2026
Summary
CVE-2025-67981 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-67981 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that enables PHP Local File Inclusion in the thembay Besa WordPress theme. This flaw affects Besa versions from n/a through 2.3.15 inclusive and is associated with CWE-98. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An unauthenticated attacker can exploit this vulnerability over the network with high attack complexity and without requiring user interaction. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, such as including and executing local PHP files on the server, potentially leading to arbitrary code execution or data exposure.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/besa/vulnerability/wordpress-besa-theme-2-3-15-local-file-inclusion-vulnerability-2?_s_id=cve documents this Local File Inclusion issue specifically in Besa theme version 2.3.15. Mitigation involves updating to a version beyond 2.3.15 if available, alongside standard WordPress theme hardening practices like restricting file permissions and monitoring for anomalous include operations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208050
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.15.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote LFI vulnerability in public-facing WordPress theme directly enables T1190 (Exploit Public-Facing Application) for initial access and facilitates T1005 (Data from Local System) by allowing inclusion and execution of arbitrary local PHP files.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the PHP Local File Inclusion vulnerability by remediating the flaw in the Besa theme through patching to versions beyond 2.3.15.
Prevents exploitation of improper filename control in PHP include/require statements by validating and sanitizing user-supplied inputs to block local file inclusion.
Enforces secure configuration settings in PHP, such as disabling allow_url_include and setting open_basedir, to restrict unauthorized file inclusion operations in the WordPress theme.