Cyber Posture

CVE-2025-60069

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mandates validation of filename inputs in PHP include/require statements to prevent improper control leading to local file inclusion in the MinimogWP theme.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of the specific PHP LFI flaw affecting MinimogWP versions through <= 3.9.6.

RA-5 Vulnerability Monitoring and Scanning partial match
preventdetect

Vulnerability scanning detects PHP remote/local file inclusion issues like CVE-2025-60069 in WordPress themes and drives remediation.

Security SummaryAI

CVE-2025-60069 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the ThemeMove MinimogWP theme for WordPress. The issue impacts MinimogWP versions from n/a through 3.9.6 and is associated with CWE-98. Published on 2025-12-18, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited remotely over the network by unauthenticated attackers with no required privileges or user interaction, though it demands high attack complexity. Successful exploitation grants high-impact access to confidential data, integrity modifications, and availability disruptions, potentially allowing attackers to include and execute local files on the server.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/minimog/vulnerability/wordpress-minimogwp-theme-3-9-2-local-file-inclusion-vulnerability?_s_id=cve, which documents the Local File Inclusion vulnerability in the MinimogWP theme.

Details

CWE(s)
CWE-98

Affected Products

thememove
minimogwp
≤ 3.9.6

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

LFI vulnerability in public-facing WordPress theme exploited remotely via T1190 (Exploit Public-Facing Application); enables reading and executing local files, facilitating T1005 (Data from Local System).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References