CVE-2025-69061
Published: 22 January 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MoveMe moveme allows PHP Local File Inclusion.This issue affects MoveMe: from n/a through <= 1.2.15.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the inadequate validation of filenames in PHP include/require statements, preventing LFI exploitation by enforcing input validation.
Mandates timely flaw remediation through patching the vulnerable MoveMe theme up to version 1.2.15.
Restricts information inputs such as filenames to safe, organization-defined values, limiting the scope for malicious file path manipulation in PHP includes.
Security SummaryAI
CVE-2025-69061 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the MoveMe WordPress theme developed by AncoraThemes. This flaw affects all versions of MoveMe up to and including 1.2.15. The vulnerability stems from inadequate validation of filenames used in PHP include/require statements, mapped to CWE-98, and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite elevated attack complexity.
Remote, unauthenticated attackers (PR:N) with network access (AV:N) can exploit this vulnerability without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation allows arbitrary local file inclusion, potentially leading to high confidentiality impact (C:H) through sensitive data disclosure, high integrity impact (I:H) via file manipulation or code injection, and high availability impact (A:H) through denial-of-service conditions, all within unchanged scope (S:U).
The primary advisory from Patchstack details the vulnerability in the MoveMe theme up to version 1.2.15 and is available at https://patchstack.com/database/Wordpress/Theme/moveme/vulnerability/wordpress-moveme-theme-1-2-15-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched version if available or applying custom fixes to input validation in affected PHP files.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-69061 is a Local/Remote File Inclusion vulnerability in a public-facing WordPress theme, directly enabling unauthenticated remote exploitation of a public-facing application.