CVE-2025-69396
Published: 20 February 2026
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-69396 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the ThemeREX Splendour WordPress theme. This issue affects Splendour versions from n/a through 1.23 inclusive. The vulnerability was published on 2026-02-20 and carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.
Remote, unauthenticated attackers can exploit this vulnerability over the network with high attack complexity and no user interaction required. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling attackers to include and execute arbitrary local PHP files on the server.
Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/splendour/vulnerability/wordpress-splendour-theme-1-23-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a local file inclusion in a public-facing WordPress theme, directly enabling remote unauthenticated exploitation of a public-facing application.