CVE-2025-68553

Critical

Published: 05 March 2026

Published

05 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0045 35.5th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-68553 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68553 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Lendiz WordPress theme developed by zozothemes. The flaw allows attackers to upload a web shell to the web server. It affects Lendiz versions from n/a through those prior to 2.0.1.

The vulnerability can be exploited by an attacker with low privileges over the network, requiring low attack complexity and no user interaction. Successful exploitation results in high impacts to confidentiality, integrity, and availability with a changed scope, as reflected in its CVSS v3.1 base score of 9.9. This enables the attacker to upload and execute a web shell, potentially leading to full server compromise.

The Patchstack advisory details the issue as an arbitrary file upload vulnerability in the Lendiz theme and states it was fixed in version 2.0.1. Mitigation involves updating to Lendiz 2.0.1 or later on affected WordPress installations.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-208301

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through < 2.0.1.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Arbitrary file upload vuln in public-facing WordPress theme directly enables web shell deployment (T1505.003) via exploitation of the exposed application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0