CVE-2025-68549
Published: 20 February 2026
Summary
CVE-2025-68549 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the unrestricted file upload flaw in Wiguard WordPress theme versions prior to 2.0.1 by identifying, reporting, and applying patches.
Requires validation of file upload inputs to reject dangerous types like web shells, preventing exploitation even in unpatched systems.
Deploys malicious code protection mechanisms at system entry points to scan and block web shells uploaded via the vulnerable theme.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct arbitrary file upload of web shell in public-facing WordPress component enables T1190 initial access and T1100 web shell deployment for RCE.
NVD Description
Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Wiguard wiguard allows Upload a Web Shell to a Web Server.This issue affects Wiguard: from n/a through < 2.0.1.
Deeper analysisAI
CVE-2025-68549 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Wiguard WordPress theme developed by zozothemes. It allows attackers to upload a web shell to the web server. The vulnerability affects all versions of Wiguard from n/a through those prior to 2.0.1. Published on 2026-02-20, it has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its high impact and scope expansion.
An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables uploading a malicious web shell, potentially granting remote code execution on the server and leading to high confidentiality, integrity, and availability impacts across the affected system and beyond due to the scope change.
The Patchstack advisory for this WordPress theme vulnerability confirms it as an arbitrary file upload issue fixed in version 2.0.1, recommending immediate updates to patched versions for mitigation.
Details
- CWE(s)