PT-2025-53099 · Thembay · Zota

Published 2025-12-24 · Updated 2025-12-25 · CVE-2025-68537

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions thembay Zota versions n/a through 1.3.14

Description An improper control of filename for include/require statement exists in thembay Zota, potentially allowing PHP Local File Inclusion. The issue involves the inclusion of files without proper validation, which could lead to unauthorized access or code execution.

Recommendations Update to a version greater than 1.3.14.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-68537

Affected Products

Zota

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-68537 · Security Note
• https://patchstack.com/database/Wordpress/Theme/zota/vulnerability/wordpress-zota-theme-1-3-14-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/TheHackerWire/status/2004299467294757186 · Twitter Post
• https://t.me/CVEtracker/40583 · Telegram Post
• https://vdp.patchstack.com/database/Wordpress/Theme/zota/vulnerability/wordpress-zota-theme-1-3-14-local-file-inclusion-vulnerability?_s_id=cve · Note