CVE-2025-69078
Published: 22 January 2026
Summary
CVE-2025-69078 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely patching of the vulnerable Malta WordPress theme up to version 1.3.3 directly eliminates the PHP Local File Inclusion flaw.
Validating filenames supplied to PHP include/require statements prevents attackers from injecting paths leading to unauthorized local file inclusion and execution.
Enforcing secure PHP configuration settings such as open_basedir restrictions and disabling allow_url_include limits the scope of file access exploitable via LFI.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI/RFI in public-facing WordPress theme directly enables exploitation of web apps (T1190) and web shell deployment/execution via arbitrary PHP file inclusion (T1505.003).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Malta malta allows PHP Local File Inclusion.This issue affects Malta: from n/a through <= 1.3.3.
Deeper analysisAI
CVE-2025-69078 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, in the AncoraThemes Malta WordPress theme. It enables PHP Local File Inclusion and affects Malta theme versions from n/a through 1.3.3. The vulnerability is associated with CWE-98 and received a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). It was published on 2026-01-22.
The vulnerability can be exploited by remote attackers over the network, requiring high attack complexity but no privileges or user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability, potentially allowing attackers to include and execute local PHP files, leading to unauthorized access or code execution on the affected WordPress site.
The Patchstack advisory provides details on this Local File Inclusion vulnerability in the WordPress Malta theme up to version 1.3.3, accessible at https://patchstack.com/database/Wordpress/Theme/malta/vulnerability/wordpress-malta-theme-1-3-3-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)