Cyber Resilience

CVE-2025-68549

Critical

Published: 20 February 2026

Published
20 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0043 34.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-68549 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68549 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Wiguard WordPress theme developed by zozothemes. It allows attackers to upload a web shell to the web server. The vulnerability affects all versions of Wiguard from n/a through those prior to 2.0.1. Published on 2026-02-20, it has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its high impact and scope expansion.

An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables uploading a malicious web shell, potentially granting remote code execution on the server and leading to high confidentiality, integrity, and availability impacts across the affected system and beyond due to the scope change.

The Patchstack advisory for this WordPress theme vulnerability confirms it as an arbitrary file upload issue fixed in version 2.0.1, recommending immediate updates to patched versions for mitigation.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Wiguard wiguard allows Upload a Web Shell to a Web Server.This issue affects Wiguard: from n/a through < 2.0.1.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Direct arbitrary file upload of web shell in public-facing WordPress component enables T1190 initial access and T1100 web shell deployment for RCE.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-22654Shared CWE-434
CVE-2025-11948Shared CWE-434
CVE-2025-67260Shared CWE-434
CVE-2025-28915Shared CWE-434
CVE-2023-53956Shared CWE-434
CVE-2025-6058Shared CWE-434
CVE-2021-47819Shared CWE-434
CVE-2025-7852Shared CWE-434
CVE-2026-4883Shared CWE-434
CVE-2019-25630Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the unrestricted file upload flaw in Wiguard WordPress theme versions prior to 2.0.1 by identifying, reporting, and applying patches.

SI-10 Information Input Validation good match
prevent

Requires validation of file upload inputs to reject dangerous types like web shells, preventing exploitation even in unpatched systems.

SI-3 Malicious Code Protection good match
preventdetect

Deploys malicious code protection mechanisms at system entry points to scan and block web shells uploaded via the vulnerable theme.

References