CVE-2025-68063: Splash WordPress Theme LFI Vulnerability

CVE-2025-68063 Overview

CVE-2025-68063 is a Local File Inclusion (LFI) vulnerability affecting the Splash - Sport Club WordPress Theme for Basketball, Football, and Hockey. The flaw impacts theme versions up to and including 4.4.3. An authenticated attacker with Contributor-level privileges can abuse the vulnerable file inclusion logic to load arbitrary local files through the WordPress application. The issue is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
An authenticated Contributor can include local files through the theme, potentially leading to sensitive information disclosure and code execution in the WordPress runtime.

Affected Products

Splash - Sport Club WordPress Theme for Basketball, Football, Hockey versions <= 4.4.3
WordPress installations with the Splash theme enabled
Sites permitting Contributor-level registration or account creation

Discovery Timeline

2026-06-26 - CVE-2025-68063 published to NVD
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2025-68063

Vulnerability Analysis

CVE-2025-68063 stems from improper control over a filename parameter passed to a PHP include or require statement within the Splash theme. The theme accepts attacker-controlled input and uses it to construct a file path without sufficient validation or allow-list enforcement. This behavior maps directly to [CWE-98], the canonical PHP Remote File Inclusion class that also covers Local File Inclusion when remote wrappers are disabled.

A Contributor account is sufficient to reach the vulnerable code path. Contributors normally have limited capabilities in WordPress, restricted to drafting posts. Any code path that grants file inclusion to that role represents a privilege boundary violation. Successful exploitation can expose configuration files such as wp-config.php, session data, or logs. Depending on server layout, an attacker may also chain the primitive with a log-poisoning or upload technique to execute PHP code.

The EPSS probability is 0.32%, reflecting a moderate near-term exploitation forecast for a theme-level flaw that requires authenticated access.

Root Cause

The root cause is the use of unsanitized user input inside a PHP file inclusion function. The theme does not restrict the included path to a fixed directory, does not strip traversal sequences such as ../, and does not validate the target against an allow list of expected template files.

Attack Vector

The attack is delivered over the network against the WordPress HTTP interface. The attacker authenticates as a Contributor, then issues a crafted request to the vulnerable theme endpoint. The request supplies a path parameter that points at a sensitive local file on the web server. The server resolves and includes the file, returning its contents or executing it as PHP if the extension is .php.

The vulnerability is described in prose only, as no verified public proof-of-concept code is available. Refer to the PatchStack Vulnerability Database Entry for further technical detail.

Detection Methods for CVE-2025-68063

Indicators of Compromise

Requests from Contributor accounts containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f in theme-related parameters.
Web server access logs showing successful HTTP 200 responses to Splash theme endpoints with unusual file, path, template, or page query parameters.
Unexpected reads of wp-config.php, /etc/passwd, or PHP session files correlated with authenticated WordPress traffic.

Detection Strategies

Inspect WordPress access logs for authenticated requests to Splash theme PHP files that pass filename-like parameters.
Deploy a Web Application Firewall (WAF) rule that blocks traversal sequences and absolute paths in query and body parameters targeting /wp-content/themes/splash/.
Alert on new or dormant Contributor accounts that begin issuing requests to theme template files shortly after login.

Monitoring Recommendations

Monitor creation of Contributor and higher-privilege accounts, and correlate with subsequent theme endpoint activity.
Track PHP include/require errors in the web server error log, which often reveal LFI probing attempts.
Baseline normal HTTP parameters used by the Splash theme and alert on deviations that resemble file paths.

How to Mitigate CVE-2025-68063

Immediate Actions Required

Update the Splash - Sport Club WordPress Theme to a version above 4.4.3 once the vendor publishes a fix.
Audit all Contributor and higher-privilege WordPress accounts and disable any that are unused or suspicious.
Restrict new user registration until the theme is patched, particularly for sites that expose self-registration.

Patch Information

At the time of publication, patch details are tracked through the PatchStack Vulnerability Database Entry. Site owners should apply the vendor-supplied update as soon as a fixed release becomes available and verify the installed theme version through the WordPress admin dashboard.

Workarounds

Deploy a virtual patch or WAF rule that blocks path traversal characters in requests targeting the Splash theme directory.
Set open_basedir and disable_functions in php.ini to constrain PHP file access to the WordPress document root.
Downgrade Contributor role capabilities using a role management plugin or remove the theme entirely if a patch is not yet available.

bash

# Configuration example: restrict PHP file access via php.ini
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off

# Example ModSecurity rule to block traversal against the Splash theme
SecRule REQUEST_URI "@contains /wp-content/themes/splash/" \
  "chain,deny,status:403,id:1006803,msg:'CVE-2025-68063 LFI attempt'"
  SecRule ARGS "@rx (\.\./|%2e%2e%2f|/etc/passwd|wp-config)" "t:lowercase,t:urlDecodeUni"