Cyber Resilience

CVE-2025-68907

High

Published: 22 January 2026

Published
22 January 2026
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0008 24.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-68907 is a high-severity Path Traversal (CWE-22) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68907 is an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability, corresponding to CWE-22, in the AivahThemes Hostme v2 WordPress theme. This flaw affects Hostme v2 versions from n/a through 7.0 inclusive and enables path traversal attacks.

With a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the vulnerability is exploitable remotely over the network by unauthenticated attackers requiring low complexity and no user interaction. Exploitation allows arbitrary file deletion, resulting in high availability impact without affecting confidentiality or integrity.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/hostmev2/vulnerability/wordpress-hostme-v2-theme-7-0-arbitrary-file-deletion-vulnerability?_s_id=cve documents this arbitrary file deletion vulnerability in Hostme v2 version 7.0 and provides details relevant to mitigation for affected WordPress installations.

EU & UK References

Vulnerability details

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through <= 7.0.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
Why these techniques?

Path traversal in public-facing WordPress theme enables remote unauthenticated arbitrary file deletion (T1190), directly supporting data destruction (T1485) and file deletion for impact or cleanup (T1070.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-24969Shared CWE-22
CVE-2024-13910Shared CWE-22
CVE-2025-65879Shared CWE-22
CVE-2025-6989Shared CWE-22
CVE-2026-31913Shared CWE-22
CVE-2024-54291Shared CWE-22
CVE-2025-67963Shared CWE-22
CVE-2026-4351Shared CWE-22
CVE-2025-68862Shared CWE-22
CVE-2026-3666Shared CWE-22

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates path traversal by validating file path inputs to prevent attackers from accessing and deleting arbitrary files outside restricted directories.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of the specific path traversal flaw in Hostme v2 theme versions through 7.0.

SC-7 Boundary Protection partial match
prevent

Boundary protection mechanisms such as web application firewalls can inspect and block path traversal payloads in remote network requests targeting the vulnerable WordPress theme.

References