Login Sign Up

CVE-2025-67527

9.8 CRITICAL

📋 TL;DR

This vulnerability allows attackers to include local files on the server through improper filename control in PHP include/require statements. It affects all WordPress sites using the Digiqole theme from unknown versions up to 2.2.6. Attackers can potentially read sensitive files or execute arbitrary code.

💻 Affected Systems

Products:
  • WordPress Digiqole Theme
Versions: n/a through < 2.2.7
Operating Systems: All operating systems running PHP
Default Config Vulnerable: ⚠️ Yes
Notes: Requires WordPress with Digiqole theme installed. PHP configuration with allow_url_include disabled may limit impact.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise leading to data theft, ransomware deployment, or complete site takeover through remote code execution.

🟠

Likely Case

Sensitive file disclosure (configuration files, database credentials) and limited code execution within web server context.

🟢

If Mitigated

File read limited to web-accessible directories if proper file permissions and web server configurations are in place.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Simple HTTP requests can trigger the vulnerability. Public exploit details available on security research sites.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.2.7

Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/digiqole/vulnerability/wordpress-digiqole-theme-2-2-7-local-file-inclusion-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Check if Digiqole theme shows update available. 4. Click Update to version 2.2.7. 5. Verify theme functions correctly after update.

🔧 Temporary Workarounds

Disable vulnerable theme

all

Temporarily switch to default WordPress theme until patch can be applied

Restrict PHP file inclusion

linux

Modify php.ini to disable dangerous PHP functions

php.ini: disable_functions = include,require,include_once,require_once

🧯 If You Can't Patch

  • Implement web application firewall (WAF) rules to block file inclusion patterns
  • Restrict file permissions and implement strict directory traversal protections

🔍 How to Verify

Check if Vulnerable:

Check WordPress theme version in wp-content/themes/digiqole/style.css or WordPress admin panel

Check Version:

grep 'Version' wp-content/themes/digiqole/style.css

Verify Fix Applied:

Confirm Digiqole theme version is 2.2.7 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

  • Unusual file paths in PHP error logs
  • Multiple requests to theme files with path traversal parameters

Network Indicators:

  • HTTP requests containing '../' patterns targeting theme files
  • Unusual file extensions in theme directory requests

SIEM Query:

web.url:*digiqole* AND (web.url:*../* OR web.param:*../*)

📊 Metadata

CVE ID: CVE-2025-67527
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-98
EPSS Score: 0.17% exploit probability (37.5th percentile)
Published: December 9, 2025
Last Updated: January 20, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-67527, you might also want to check these:

CVE-2025-25174 10.0

This CVE describes a PHP Local File Inclusion vulnerability in the BeeTeam368 Extensions WordPress p...

Same vulnerability type (CWE-98)
CVE-2025-49994 9.8

This vulnerability allows attackers to include local files on the server through improper filename c...

Same vulnerability type (CWE-98)
CVE-2025-50003 9.8

This vulnerability allows attackers to include local PHP files through improper filename control in ...

Same vulnerability type (CWE-98)