CVE-2025-69397
Published: 20 February 2026
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-69397 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the ThemeREX Tint WordPress theme. This issue affects all versions of Tint from n/a through 1.7 inclusive. The vulnerability was published on 2026-02-20 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote, unauthenticated attackers can exploit this vulnerability over the network without user interaction, though it requires high attack complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing attackers to include and execute local files on the server.
The Patchstack advisory provides details on this Local File Inclusion vulnerability in the WordPress Tint theme version 1.7 and recommends mitigation measures, available at https://patchstack.com/database/Wordpress/Theme/tint/vulnerability/wordpress-tint-theme-1-7-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
This PHP Remote/Local File Inclusion vulnerability in a public-facing WordPress theme enables unauthenticated remote attackers to achieve code execution and data exposure by exploiting the web application, directly mapping to T1190: Exploit Public-Facing Application.