CVE-2025-69075: 
WordPress vulnerability analysis and mitigation

CVE-2025-69075 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes Yolox WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Yolox theme through 1.0.15. The vulnerability was reported by Patchstack and published on January 22, 2026. It carries a CVSS v3.1 base score of 8.1 (High), as assessed by CISA-ADP (Patchstack, NVD).

The vulnerability stems from improper control of filename parameters used in PHP include/require statements within the Yolox theme (CWE-98). An attacker can manipulate filename-based input parameters to cause the PHP interpreter to include arbitrary local files from the server's filesystem. While the CWE classification references PHP Remote File Inclusion, the actual attack vector is Local File Inclusion (LFI), meaning the attacker can read files already present on the server rather than injecting remote code directly. No public proof-of-concept code has been identified at this time (Patchstack, NVD).

Successful exploitation allows an attacker to read arbitrary files from the web server's filesystem, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, application secrets, and other confidential information. The CVSS assessment reflects high impacts to confidentiality, integrity, and availability, indicating that under certain conditions (e.g., log poisoning chained with LFI), the vulnerability could be escalated to remote code execution. This could facilitate further lateral movement within the hosting environment or complete site compromise (NVD, Patchstack).

No public proof-of-concept exploit code has been observed, and there is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack complexity is rated High (AC:H), and no authentication or user interaction is required per the CISA-ADP CVSS assessment (NVD, Patchstack).

Organizations using the Yolox WordPress theme should update to a version newer than 1.0.15 as soon as a patched release is made available by AncoraThemes. In the interim, the following mitigations are recommended:

• Disable or replace the theme if it is not critical to operations until a patch is confirmed.
• Implement WAF rules to detect and block requests containing path traversal sequences (e.g., ../, ..%2F) targeting theme file inclusion parameters.
• Restrict PHP file inclusion at the server level using open_basedir directives to limit accessible directories.
• Monitor server logs for unusual file access patterns indicative of LFI attempts.
• Apply least privilege to the web server process to minimize the impact of file disclosure (Patchstack).

The vulnerability was reported and disclosed by Patchstack, which assigned the CVE and published the advisory. Wordfence referenced the vulnerability in its weekly WordPress vulnerability report covering the period of December 15, 2025 to January 4, 2026. No significant broader community discussion or media coverage has been identified beyond standard vulnerability aggregation platforms (Wordfence, Patchstack).