CVE-2025-69046: 
WordPress vulnerability analysis and mitigation

CVE-2025-69046 is a PHP Local File Inclusion (LFI) vulnerability in the WebGeniusLab iRecco Core WordPress plugin (slug: irecco-core). It stems from improper control of filenames used in PHP include/require statements, allowing unauthenticated attackers to include arbitrary local files on the server. All versions of iRecco Core through 1.3.6 are affected. The vulnerability was published on January 22, 2026, by Patchstack, and carries a CVSS v3.1 base score of 8.1 (High) as assessed by CISA-ADP (Patchstack, NVD).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program — 'PHP Remote File Inclusion'), but the actual exploitation path is Local File Inclusion (LFI). The root cause is insufficient sanitization or validation of user-supplied input that is passed directly to a PHP include() or require() statement within the iRecco Core plugin. An unauthenticated remote attacker can craft a network request that manipulates the filename parameter to traverse the file system and include sensitive server-side files. No authentication or user interaction is required, though the attack complexity is rated High, suggesting specific conditions or knowledge may be needed to exploit it reliably (NVD, Patchstack).

Successful exploitation can allow an unauthenticated attacker to read sensitive server files (e.g., WordPress wp-config.php containing database credentials), and under certain conditions — such as when combined with a file upload or log poisoning technique — achieve remote code execution (RCE). The confidentiality, integrity, and availability impacts are all rated High, meaning a complete compromise of the affected WordPress installation is possible. This could expose database credentials, authentication keys, and other sensitive configuration data, and may facilitate lateral movement within the hosting environment (NVD, Patchstack).

As of the time of reporting, there is no public proof-of-concept (PoC) exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.049%, indicating a low current probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Patchstack, NVD).

1. Reconnaissance: Identify WordPress sites running the iRecco Core plugin (version ≤ 1.3.6) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files in the plugin directory (/wp-content/plugins/irecco-core/readme.txt).
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or observed HTTP traffic to locate the endpoint and parameter that passes user input to a PHP include() or require() call without adequate sanitization.
3. Craft LFI payload: Construct an HTTP request with a path traversal payload in the vulnerable parameter (e.g., ../../../../wp-config.php or ../../../../etc/passwd) to attempt inclusion of sensitive files.
4. Retrieve sensitive data: If successful, the server response will contain the contents of the included file, potentially exposing database credentials from wp-config.php or system user information from /etc/passwd.
5. Escalate to RCE (if conditions allow): Chain the LFI with a file upload vulnerability or PHP session log poisoning to include a PHP web shell, achieving remote code execution on the server.

• Network: Unusual HTTP GET or POST requests to WordPress endpoints associated with the iRecco Core plugin (/wp-content/plugins/irecco-core/) containing path traversal sequences such as ../, ..%2F, or %2e%2e%2f in query parameters or request bodies.
• Logs: WordPress or web server access logs (e.g., Apache access.log, Nginx access.log) showing requests with encoded traversal strings targeting iRecco Core plugin endpoints; PHP error logs referencing failed include() or require() calls with unexpected file paths.
• File System: Unexpected new PHP files (potential web shells) in the WordPress uploads directory (/wp-content/uploads/) or plugin directories; modification timestamps on core WordPress files that do not align with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, nginx, php-fpm) such as bash, curl, wget, or python executing commands not typical of normal WordPress operation.

Users of the iRecco Core WordPress plugin should upgrade to a version newer than 1.3.6 as soon as a patched release becomes available from WebGeniusLab. If no patch is yet available, the recommended interim mitigations include: deploying Web Application Firewall (WAF) rules to detect and block path traversal and file inclusion patterns in HTTP requests; disabling or deactivating the iRecco Core plugin if it is not critical to site operations; and restricting access to the WordPress admin panel and plugin endpoints via IP allowlisting. Monitoring web server and PHP error logs for anomalous file inclusion attempts is also advised (Patchstack).

The vulnerability was reported by Patchstack, a WordPress security platform, and was noted in the Wordfence Intelligence weekly WordPress vulnerability report covering the period of December 15, 2025 to January 4, 2026. No significant broader media coverage, vendor statements from WebGeniusLab, or notable researcher commentary beyond the initial disclosure have been identified at this time (Wordfence).