CVE-2025-68067 HIGH

CVE-2025-68067: WordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerability

Vendor Select-Themes
Product Stockholm Core
Weakness CWE-98 · PHP file inclusion
Published December 16, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm-core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through <= 2.4.6.

Explanation of Vulnerability in Simple Terms

02Summary

Stockholm Core versions up to 2.4.6 contain a remote code execution vulnerability affecting authenticated users with low privileges. An attacker with valid login credentials can exploit a flaw to execute arbitrary code on the site. The vulnerability requires network access and specific conditions to trigger, but grants full control over site data and functionality once exploited.

What an attacker can do

03Attacker Capabilities

Execute arbitrary code on the site, read/modify all data, and take full control of the installation.

Potential impact on your site

04Site Impact

Any authenticated user account can be leveraged to compromise the entire site, including database access and file system control.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges and network access to the site.

Key dates

06Disclosure timeline

December 16, 2025 CVE published
April 28, 2026 Record updated