CVE-2025-67934 Mikado-Themes CVE debrief

Who should care

Defenders responsible for WordPress installations using the Wellspring theme should assess exposure and prioritize updates to mitigate this vulnerability.

Why it matters

CVE-2025-67934 is a HIGH-severity vulnerability in the Wellspring theme for WordPress, allowing for PHP Local File Inclusion. Defenders should prioritize updates to version 2.8 or later and monitor for potential exploitation attempts.

• Potential for local file inclusion, allowing attackers to read or execute local files
• HIGH severity with a CVSS score of 8.1, indicating significant risk
• Requires immediate attention and mitigation to prevent potential exploitation

Technical summary

The Wellspring theme for WordPress, affecting versions from n/a through < 2.8, is vulnerable to PHP Remote File Inclusion, allowing for PHP Local File Inclusion with a CVSS score of 8.1 and classified as HIGH severity. This vulnerability enables attackers to potentially read or execute local files on the server. Defenders should assess exposure and prioritize updates to version 2.8 or later, considering the HIGH severity and potential for local file inclusion. The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score and

Defensive priority

Defenders should prioritize updating the Wellspring theme to version 2.8 or later to mitigate this vulnerability. This requires immediate attention due to the HIGH severity and potential for local file inclusion.

Recommended defensive actions

• Update the Wellspring theme to version 2.8 or later
• Review server logs for potential exploitation attempts
• Implement additional monitoring for file inclusion activities

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its CVSS score and affected versions. However, there is limited information on potential exploits or impacts, suggesting a need for further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.