CVE-2025-69075
Published: 22 January 2026
Summary
CVE-2025-69075 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identification, reporting, and correction of the specific PHP Local File Inclusion flaw in the Yolox WordPress theme up to version 1.0.15.
Requires validation of user-supplied inputs used in PHP include/require statements to block improper filename control exploited in this LFI vulnerability.
Enables vulnerability scanning to identify the PHP Remote/Local File Inclusion issue in Yolox, facilitating timely remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of public-facing WordPress theme via LFI/RFI vulnerability (CWE-98).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Yolox yolox allows PHP Local File Inclusion.This issue affects Yolox: from n/a through <= 1.0.15.
Deeper analysisAI
CVE-2025-69075 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the Yolox WordPress theme developed by AncoraThemes. This issue affects all versions of Yolox up to and including 1.0.15.
Unauthenticated remote attackers can exploit the vulnerability over the network, though it requires high attack complexity and no user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability, as reflected in its CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Mitigation details are documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/yolox/vulnerability/wordpress-yolox-theme-1-0-15-local-file-inclusion-vulnerability?_s_id=cve. The vulnerability was published on 2026-01-22.
Details
- CWE(s)