CVE-2025-69047
Published: 22 January 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech MaxShop sw_maxshop allows PHP Local File Inclusion.This issue affects MaxShop: from n/a through <= 3.6.20.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the LFI vulnerability by requiring timely remediation through patching or updating the vulnerable MaxShop WordPress theme to prevent exploitation.
Mandates validation of inputs to PHP include/require statements, directly countering the improper filename control that enables local file inclusion attacks.
Enforces secure configuration settings in PHP, such as open_basedir restrictions, to limit the scope of local file access even if input validation fails.
Security SummaryAI
CVE-2025-69047 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, known as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the magentech MaxShop sw_maxshop WordPress theme. This issue affects MaxShop versions from an unspecified initial release through 3.6.20. Published on 2026-01-22, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and potential for significant impact.
The vulnerability can be exploited by unauthenticated attackers over the network without requiring user interaction, though it demands high attack complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing attackers to include and potentially execute arbitrary local PHP files, leading to unauthorized file reads, data exposure, or code execution depending on server configuration.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/sw_maxshop/vulnerability/wordpress-maxshop-theme-3-6-20-local-file-inclusion-vulnerability?_s_id=cve documents the local file inclusion flaw in the WordPress MaxShop theme up to version 3.6.20, recommending updates to patched versions where available or alternative mitigations such as input validation on file inclusion parameters.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote local file inclusion (LFI) flaw in a public-facing WordPress theme, directly enabling exploitation of a public-facing application as per T1190.