Cyber Posture

CVE-2025-69061

High

Published: 22 January 2026

Published
22 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MoveMe moveme allows PHP Local File Inclusion.This issue affects MoveMe: from n/a through <= 1.2.15.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the inadequate validation of filenames in PHP include/require statements, preventing LFI exploitation by enforcing input validation.

prevent

Mandates timely flaw remediation through patching the vulnerable MoveMe theme up to version 1.2.15.

prevent

Restricts information inputs such as filenames to safe, organization-defined values, limiting the scope for malicious file path manipulation in PHP includes.

Security SummaryAI

CVE-2025-69061 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the MoveMe WordPress theme developed by AncoraThemes. This flaw affects all versions of MoveMe up to and including 1.2.15. The vulnerability stems from inadequate validation of filenames used in PHP include/require statements, mapped to CWE-98, and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite elevated attack complexity.

Remote, unauthenticated attackers (PR:N) with network access (AV:N) can exploit this vulnerability without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation allows arbitrary local file inclusion, potentially leading to high confidentiality impact (C:H) through sensitive data disclosure, high integrity impact (I:H) via file manipulation or code injection, and high availability impact (A:H) through denial-of-service conditions, all within unchanged scope (S:U).

The primary advisory from Patchstack details the vulnerability in the MoveMe theme up to version 1.2.15 and is available at https://patchstack.com/database/Wordpress/Theme/moveme/vulnerability/wordpress-moveme-theme-1-2-15-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched version if available or applying custom fixes to input validation in affected PHP files.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CVE-2025-69061 is a Local/Remote File Inclusion vulnerability in a public-facing WordPress theme, directly enabling unauthenticated remote exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References