CVE-2025-68506

High

Published: 24 December 2025

Published

24 December 2025

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0041 32.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-68506 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68506 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion (CWE-98), in the Docket Cache WordPress plugin developed by Nawawi Jamili. The flaw allows PHP Local File Inclusion and affects Docket Cache versions from n/a through 24.07.03 inclusive. It was published on 2025-12-24.

The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility with high attack complexity, no privileges or user interaction required, and unchanged scope. Unauthenticated attackers can exploit it remotely to achieve high confidentiality, integrity, and availability impacts through local file inclusion.

The Patchstack advisory provides further details on the vulnerability at https://patchstack.com/database/Wordpress/Plugin/docket-cache/vulnerability/wordpress-docket-cache-plugin-24-07-03-local-file-inclusion-vulnerability?_s_id=cve.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-205271

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through <= 24.07.03.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is a critical unauthenticated remote file inclusion flaw in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application for arbitrary file reads and remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0