CVE-2025-69061
Published: 22 January 2026
Summary
CVE-2025-69061 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69061 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the MoveMe WordPress theme developed by AncoraThemes. This flaw affects all versions of MoveMe up to and including 1.2.15. The vulnerability stems from inadequate validation of filenames used in PHP include/require statements, mapped to CWE-98, and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite elevated attack complexity.
Remote, unauthenticated attackers (PR:N) with network access (AV:N) can exploit this vulnerability without user interaction (UI:N), though it requires high attack complexity (AC:H). Successful exploitation allows arbitrary local file inclusion, potentially leading to high confidentiality impact (C:H) through sensitive data disclosure, high integrity impact (I:H) via file manipulation or code injection, and high availability impact (A:H) through denial-of-service conditions, all within unchanged scope (S:U).
The primary advisory from Patchstack details the vulnerability in the MoveMe theme up to version 1.2.15 and is available at https://patchstack.com/database/Wordpress/Theme/moveme/vulnerability/wordpress-moveme-theme-1-2-15-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched version if available or applying custom fixes to input validation in affected PHP files.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3924
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MoveMe moveme allows PHP Local File Inclusion.This issue affects MoveMe: from n/a through <= 1.2.15.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2025-69061 is a Local/Remote File Inclusion vulnerability in a public-facing WordPress theme, directly enabling unauthenticated remote exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the inadequate validation of filenames in PHP include/require statements, preventing LFI exploitation by enforcing input validation.
Mandates timely flaw remediation through patching the vulnerable MoveMe theme up to version 1.2.15.
Restricts information inputs such as filenames to safe, organization-defined values, limiting the scope for malicious file path manipulation in PHP includes.