CVE-2025-69396
Published: 20 February 2026
Summary
CVE-2025-69396 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-69396 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (CWE-98), in the ThemeREX Splendour WordPress theme. This issue affects Splendour versions from n/a through 1.23 inclusive. The vulnerability was published on 2026-02-20 and carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.
Remote, unauthenticated attackers can exploit this vulnerability over the network with high attack complexity and no user interaction required. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling attackers to include and execute arbitrary local PHP files on the server.
Mitigation details are available in advisories such as the Patchstack database entry at https://patchstack.com/database/Wordpress/Theme/splendour/vulnerability/wordpress-splendour-theme-1-23-local-file-inclusion-vulnerability?_s_id=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207971
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Splendour splendour allows PHP Local File Inclusion.This issue affects Splendour: from n/a through <= 1.23.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a local file inclusion in a public-facing WordPress theme, directly enabling remote unauthenticated exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the PHP Local File Inclusion flaw in the Splendour WordPress theme by applying vendor patches to affected versions up to 1.23.
Enforces validation of filenames supplied to PHP include/require statements, preventing attackers from specifying arbitrary local files for execution.
Establishes secure PHP configuration settings like open_basedir to limit accessible directories, reducing the impact of improper filename controls in file inclusion.