Cyber Posture

CVE-2025-68907

High

Published: 22 January 2026

Published
22 January 2026
Modified
27 April 2026
KEV Added
Patch
CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0007 21.7th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-68907 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
Why these techniques?

Path traversal in public-facing WordPress theme enables remote unauthenticated arbitrary file deletion (T1190), directly supporting data destruction (T1485) and file deletion for impact or cleanup (T1070.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0.

Deeper analysisAI

CVE-2025-68907 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, corresponding to CWE-22, in the AivahThemes Hostme v2 WordPress theme. This flaw affects Hostme v2 versions from n/a through 7.0 inclusive and enables path traversal attacks.

With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability is exploitable remotely over the network by unauthenticated attackers requiring low complexity and no user interaction. Exploitation allows arbitrary file deletion, resulting in high availability impact without affecting confidentiality or integrity.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-arbitrary-file-deletion-vulnerability?_s_id=cve documents this arbitrary file deletion vulnerability in Hostme v2 version 7.0 and provides details relevant to mitigation for affected WordPress installations.

Details

CWE(s)

CVEs Like This One

CVE-2025-65879Shared CWE-22
CVE-2026-31913Shared CWE-22
CVE-2026-24969Shared CWE-22
CVE-2025-6989Shared CWE-22
CVE-2024-54291Shared CWE-22
CVE-2025-14868Shared CWE-22
CVE-2026-33293Shared CWE-22
CVE-2024-8898Shared CWE-22
CVE-2025-2328Shared CWE-22
CVE-2025-66251Shared CWE-22

References