Cyber Resilience

CVE-2025-68986

Critical

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0043 34.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2025-68986 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.9 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-68986 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the zozothemes Miion WordPress theme. Published on 2026-01-22, it affects Miion versions from n/a through 1.2.7 and carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The issue enables attackers to upload web shells directly to the web server.

An attacker with low privileges, such as an authenticated WordPress user, can exploit this over the network with low complexity and no user interaction. Successful exploitation allows uploading a malicious web shell, resulting in high impacts across confidentiality, integrity, and availability, potentially granting full control over the affected server.

The Patchstack advisory documents this as an arbitrary file upload vulnerability in Miion theme version 1.2.7 and provides vulnerability details for mitigation.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Miion miion allows Upload a Web Shell to a Web Server.This issue affects Miion: from n/a through <= 1.2.7.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
attack.mitre.org →
Why these techniques?

Direct arbitrary file upload enables web shell deployment on public-facing WordPress server (T1505.003) and exploitation of exposed web application (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-22654Shared CWE-434
CVE-2025-11948Shared CWE-434
CVE-2025-67260Shared CWE-434
CVE-2025-28915Shared CWE-434
CVE-2023-53956Shared CWE-434
CVE-2025-6058Shared CWE-434
CVE-2021-47819Shared CWE-434
CVE-2025-7852Shared CWE-434
CVE-2026-4883Shared CWE-434
CVE-2019-25630Shared CWE-434

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Flaw remediation requires timely patching of the Miion theme vulnerability (versions <=1.2.7), directly eliminating the unrestricted file upload capability exploited by attackers.

SI-10 Information Input Validation good match
prevent

Information input validation mechanisms at file upload points comprehensively check and reject dangerous file types like web shells.

SI-9 Information Input Restrictions good match
prevent

Information input restrictions enforce limits on file types, sizes, and extensions to block unrestricted uploads of dangerous files in the Miion theme.

References