CVE-2025-68539
Published: 20 February 2026
Summary
CVE-2025-68539 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-68539 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion, in the thembay Fana WordPress theme. This flaw enables PHP Local File Inclusion and affects Fana theme versions from n/a through 1.1.35 inclusive. The vulnerability is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
Remote unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) without requiring user interaction (UI:N), though it demands high attack complexity (AC:H). Successful exploitation allows attackers to achieve high-impact outcomes, including unauthorized access to local files via local file inclusion, with unchanged scope (S:U).
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/fana/vulnerability/wordpress-fana-theme-1-1-35-local-file-inclusion-vulnerability-2?_s_id=cve provides details on this Local File Inclusion vulnerability in the WordPress Fana theme version 1.1.35. The CVE was published on 2026-02-20T16:22:11.373.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208083
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local File Inclusion.This issue affects Fana: from n/a through <= 1.1.35.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme enables exploitation of public-facing application (T1190) and facilitates unauthorized access to data from local system files (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of system flaws, directly mitigating this LFI vulnerability by patching the affected Fana WordPress theme versions through 1.1.35.
Mandates validation of information inputs such as user-supplied filenames in PHP include/require statements, preventing improper control exploited in this PHP LFI vulnerability.
Implements restrictions on information inputs to limit filenames to authorized and safe paths, reducing the attack surface for local file inclusion in the Fana theme.