Cyber Resilience

CVE-2025-68554

Critical

Published: 05 March 2026

Published
05 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0043 34.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-68554 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68554 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the Keenarch WordPress theme developed by zozothemes. The flaw enables the use of malicious files through unrestricted file uploads and affects Keenarch versions from n/a through those prior to 2.0.1.

The vulnerability carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), marking it as critical. It can be exploited remotely by an authenticated attacker with low privileges, requiring low complexity and no user interaction, potentially leading to high impacts on confidentiality, integrity, and availability due to the changed scope.

The Patchstack advisory details the arbitrary file upload vulnerability in the Keenarch theme and confirms it was fixed in version 2.0.1. Mitigation involves updating affected WordPress sites running the Keenarch theme to version 2.0.1 or later.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Keenarch keenarch allows Using Malicious Files.This issue affects Keenarch: from n/a through < 2.0.1.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Unrestricted file upload (CWE-434) in public-facing WordPress theme directly enables remote code execution via web shell deployment.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-22654Shared CWE-434
CVE-2025-11948Shared CWE-434
CVE-2025-67260Shared CWE-434
CVE-2025-28915Shared CWE-434
CVE-2023-53956Shared CWE-434
CVE-2025-6058Shared CWE-434
CVE-2021-47819Shared CWE-434
CVE-2025-7852Shared CWE-434
CVE-2026-4883Shared CWE-434
CVE-2019-25630Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of uploaded files to reject dangerous types, preventing exploitation of the unrestricted file upload vulnerability in the Keenarch theme.

SI-2 Flaw Remediation good match
prevent

Requires timely patching of the Keenarch theme to version 2.0.1 or later, eliminating the specific unrestricted upload flaw.

SI-3 Malicious Code Protection good match
preventdetect

Scans uploaded files for malicious code, mitigating the execution of dangerous files even if uploaded via the Keenarch vulnerability.

References