Cyber Posture

CVE-2025-69046

High

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab iRecco Core irecco-core allows PHP Local File Inclusion.This issue affects iRecco Core: from n/a through <= 1.3.6.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

SI-10 requires validation of untrusted inputs like filenames in PHP include/require statements to prevent arbitrary local file inclusion in the iRecco Core plugin.

SI-2 Flaw Remediation good match
prevent

SI-2 mandates timely remediation of identified flaws, directly addressing this LFI vulnerability by patching iRecco Core versions through 1.3.6.

SC-7 Boundary Protection partial match
preventdetect

SC-7 implements boundary protections like web application firewalls to inspect and block network requests exploiting the PHP file inclusion flaw.

Security SummaryAI

CVE-2025-69046 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and commonly referred to as PHP Remote File Inclusion, present in the WebGeniusLab iRecco Core WordPress plugin (irecco-core). The flaw enables PHP Local File Inclusion and affects all versions from n/a through 1.3.6 inclusive. It carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

Unauthenticated remote attackers (PR:N) can exploit this vulnerability over the network (AV:N) without requiring user interaction (UI:N), though it demands high attack complexity (AC:H). Successful exploitation grants high-level impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) within unchanged scope (S:U), typically allowing attackers to include and potentially execute arbitrary local PHP files on the affected server.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/irecco-core/vulnerability/wordpress-irecco-core-plugin-1-3-6-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
attack.mitre.org →
Why these techniques?

T1190 for exploiting the public-facing WordPress plugin vulnerability; T1005 for Local File Inclusion enabling arbitrary local file reads.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References