CVE-2025-68543
Published: 20 February 2026
Summary
CVE-2025-68543 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 42.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-68543 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that enables PHP Local File Inclusion in the Diza WordPress theme developed by thembay. This issue affects Diza versions from n/a through 1.3.15. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to significant impacts on confidentiality, integrity, and availability.
The vulnerability can be exploited by unauthenticated remote attackers over the network, requiring high attack complexity but no user interaction or privileges. Attackers can manipulate filename controls in PHP include/require statements to achieve local file inclusion, potentially leading to unauthorized access to sensitive local files, code execution, or system compromise depending on the included files and server configuration.
Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/diza/vulnerability/wordpress-diza-theme-1-3-15-local-file-inclusion-vulnerability-2?_s_id=cve, which documents the vulnerability in the Diza theme up to version 1.3.15.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207921
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.15.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local file inclusion (LFI) in a public-facing WordPress theme, directly enabling exploitation of a public-facing application via remote code execution on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper control of filename inputs in PHP include/require statements by mandating validation to prevent local file inclusion attacks.
Requires identification, reporting, and correction of flaws like this LFI vulnerability in the Diza WordPress theme through timely patching.
Enforces secure configuration settings in PHP (e.g., open_basedir, disable_functions) and WordPress to restrict unauthorized file access via inclusion.