CVE-2025-68907: Arbitrary File Access in Hostme v2

The Arbitrary File Access vulnerability allows an attacker to bypass intended security restrictions and access files outside of the intended directory. A successful exploit could lead to the disclosure of sensitive information such as configuration files, database credentials, or even source code. Depending on the files accessible, this could enable further compromise of the WordPress site and potentially the underlying server. While this vulnerability doesn't directly lead to remote code execution, the information gained could be used to identify and exploit other vulnerabilities.

1. Reserved2025-12-24
2. Published2026-01-22
3. Modified2026-04-28
4. EPSS updated2026-03-23

The primary mitigation is to upgrade Hostme v2 to a patched version as soon as it becomes available from AivahThemes. In the interim, implement a Web Application Firewall (WAF) with rules to filter out malicious path traversal attempts. Specifically, look for patterns like '../' or '\..' in user-supplied input. Additionally, restrict file permissions on sensitive directories to prevent unauthorized access. Regularly review WordPress plugin configurations for any unusual file access patterns.