CVE-2025-69062
Published: 22 January 2026
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Weedles weedles allows PHP Local File Inclusion.This issue affects Weedles: from n/a through <= 1.1.12.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-69062 by requiring timely identification, testing, and remediation of the local file inclusion flaw in the Weedles WordPress theme.
Prevents exploitation of the improper filename control in PHP include/require by validating filenames and paths to block unauthorized local file inclusion.
Enforces secure PHP configuration settings like open_basedir and allow_url_include=Off to restrict file access and limit LFI impact in vulnerable themes.
Security SummaryAI
CVE-2025-69062 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that enables PHP Local File Inclusion (CWE-98) in the Weedles WordPress theme developed by AncoraThemes. This issue affects all versions of Weedles from n/a through 1.1.12. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited remotely over the network by unauthenticated attackers, though it requires high attack complexity and no user interaction. Successful exploitation allows attackers to perform local file inclusion, potentially leading to unauthorized access to sensitive local files on the server, with high impacts on confidentiality, integrity, and availability depending on the included files and server configuration.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/weedles/vulnerability/wordpress-weedles-theme-1-1-12-local-file-inclusion-vulnerability?_s_id=cve) documents this local file inclusion vulnerability in Weedles version 1.1.12, providing details relevant to mitigation for affected WordPress installations.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an LFI in a public-facing WordPress theme, directly enabling exploitation of a public-facing application for arbitrary file reads and potential RCE.