CVE-2025-67937 Mikado-Themes CVE debrief

Who should care

Defenders responsible for WordPress installations using the Hendon theme, especially those with versions prior to 1.7, should assess exposure and prioritize updates to mitigate this vulnerability.

Why it matters

CVE-2025-67937 is a high-severity vulnerability in the WordPress Hendon theme, allowing for PHP Local File Inclusion. Defenders should prioritize updates to version 1.7 or later to mitigate potential code execution and unauthorized access risks.

• Potential code execution through PHP Remote File Inclusion
• Possible unauthorized access to sensitive data
• Risk of privilege escalation for attackers
• Need for immediate version updates to prevent exploitation

Technical summary

The Hendon theme for WordPress, versions from n/a through < 1.7, is vulnerable to PHP Local File Inclusion. This vulnerability, CVE-2025-67937, allows attackers to include local or remote files, potentially leading to code execution. Defenders should prioritize updating to version 1.7 or later. This requires immediate attention, especially for WordPress installations using affected theme versions, to mitigate potential code execution and unauthorized access risks. The vulnerability has a CVSS score of 8.1, classified as HIGH severity.

Defensive priority

Defenders should prioritize updating the Hendon theme to version 1.7 or later to mitigate this vulnerability. This requires immediate attention, especially for WordPress installations using the affected theme versions.

Recommended defensive actions

• Update the Hendon theme to version 1.7 or later
• Review WordPress installations for the affected theme versions
• Monitor for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, specific details about exploitation or victim impact are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.