{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","packageName":"zota","product":"Zota","source":"CNA: Patchstack","vendor":"thembay","versions":[{"changes":[{"at":"1.3.15","status":"unaffected"}],"lessThanOrEqual":"1.3.14","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2025-68537","cwes":["CWE-98"],"description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through <= 1.3.14.","epss":{"date":"2026-11-03","percentile":0.32836,"score":0.00387},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: Patchstack","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793751281920,"publishedAt":1766579487277,"references":[{"source":"CNA: Patchstack","tags":["vdb-entry"],"url":"https://patchstack.com/database/Wordpress/Theme/zota/vulnerability/wordpress-zota-theme-1-3-14-local-file-inclusion-vulnerability?_s_id=cve"}],"remediation":[],"revision":"13eefbe6d611b6b606c8005a2ef4435f0d97e73af13f65097d52c584bd0de93e","sources":[{"modifiedAt":1793751281920,"name":"CNA: Patchstack","retrievedAt":1793754630112,"url":"https://www.cve.org/CVERecord?id=CVE-2025-68537"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793748134341,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-68537"}],"ssvc":{"assessedAt":1777315143486,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability","updatedAt":1793754630112}