CVE-2025-69072

High

Published: 22 January 2026

Published

22 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0051 39.6th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-69072 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-69072 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion (CWE-98). It affects the Prider WordPress theme developed by AncoraThemes, impacting all versions from n/a through 1.1.3.1. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, high attack complexity, no privileges required, no user interaction needed, unchanged scope, and high impacts on confidentiality, integrity, and availability.

Remote, unauthenticated attackers can exploit this vulnerability over the network by manipulating filenames in PHP include/require statements within the affected theme. Successful exploitation allows local file inclusion, potentially enabling attackers to read sensitive local files, execute arbitrary code, or disrupt system availability, aligning with the high CVSS impacts on confidentiality, integrity, and availability.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/prider/vulnerability/wordpress-prider-theme-1-1-3-1-local-file-inclusion-vulnerability?_s_id=cve) documents this local file inclusion vulnerability in the Prider WordPress theme version 1.1.3.1, providing details for security practitioners on the issue.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-3930

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP Local File Inclusion.This issue affects Prider: from n/a through <= 1.1.3.1.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

LFI in public-facing WordPress theme directly enables remote exploitation (T1190), local file reads (T1005), and arbitrary PHP code execution via web shell inclusion (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0