CVE-2025-67981
Local File Inclusion Vulnerability in thembay Besa
Publication date: 2026-02-20
Last updated on: 2026-02-24
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thembay | besa | to 2.3.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67981 is a Local File Inclusion (LFI) vulnerability in the WordPress Besa Theme versions up to and including 2.3.15.
This vulnerability allows an unauthenticated attacker to include and display local files from the target website by exploiting improper control of filename for include/require statements in PHP.
As a result, sensitive information such as database credentials can be exposed.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'Exploitation of this vulnerability can lead to exposure of sensitive information including database credentials.'}, {'type': 'paragraph', 'content': "Depending on the website's configuration, an attacker could potentially achieve a complete database takeover."}, {'type': 'paragraph', 'content': 'The vulnerability requires no privileges to exploit, making it easier for attackers to leverage.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability allows an unauthenticated attacker to include and display local files from the target website, which can be detected by monitoring for suspicious HTTP requests attempting to exploit Local File Inclusion (LFI) in the Besa WordPress theme.'}, {'type': 'paragraph', 'content': 'To detect exploitation attempts, you can look for unusual URL parameters or requests that try to include local files, such as requests containing patterns like "../../" or attempts to access sensitive files.'}, {'type': 'paragraph', 'content': 'While specific commands are not provided in the resources, common detection methods include using web server logs analysis and network monitoring tools to search for suspicious request patterns.'}, {'type': 'list_item', 'content': 'Use grep or similar tools on web server logs to find requests with suspicious parameters, e.g., `grep -r "..\\/..\\/" /var/log/apache2/access.log`'}, {'type': 'list_item', 'content': "Monitor HTTP requests for attempts to access local files by filtering logs for keywords like 'include', 'require', or file extensions such as '.php', '.txt', '.conf'."}, {'type': 'list_item', 'content': 'Use intrusion detection systems (IDS) or web application firewalls (WAF) with rules targeting LFI patterns, such as those provided by Patchstack.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate and most effective mitigation step is to update the Besa WordPress theme to version 2.3.16 or later, where this vulnerability has been patched.
Until the update can be applied, it is strongly advised to implement mitigation rules provided by Patchstack to block attacks targeting this vulnerability.
Because the vulnerability requires no privileges to exploit, applying these mitigations promptly is critical to prevent potential local file inclusion attacks and exposure of sensitive information.