CVE-2025-69047
Published: 22 January 2026
Summary
CVE-2025-69047 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69047 is an Improper Control of Filename for Include/Require Statement vulnerability in PHP programs, known as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the magentech MaxShop sw_maxshop WordPress theme. This issue affects MaxShop versions from an unspecified initial release through 3.6.20. Published on 2026-01-22, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and potential for significant impact.
The vulnerability can be exploited by unauthenticated attackers over the network without requiring user interaction, though it demands high attack complexity. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, allowing attackers to include and potentially execute arbitrary local PHP files, leading to unauthorized file reads, data exposure, or code execution depending on server configuration.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/sw_maxshop/vulnerability/wordpress-maxshop-theme-3-6-20-local-file-inclusion-vulnerability?_s_id=cve documents the local file inclusion flaw in the WordPress MaxShop theme up to version 3.6.20, recommending updates to patched versions where available or alternative mitigations such as input validation on file inclusion parameters.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3953
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech MaxShop sw_maxshop allows PHP Local File Inclusion.This issue affects MaxShop: from n/a through <= 3.6.20.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an unauthenticated remote local file inclusion (LFI) flaw in a public-facing WordPress theme, directly enabling exploitation of a public-facing application as per T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the LFI vulnerability by requiring timely remediation through patching or updating the vulnerable MaxShop WordPress theme to prevent exploitation.
Mandates validation of inputs to PHP include/require statements, directly countering the improper filename control that enables local file inclusion attacks.
Enforces secure configuration settings in PHP, such as open_basedir restrictions, to limit the scope of local file access even if input validation fails.