CVE-2025-69339: 
WordPress vulnerability analysis and mitigation

CVE-2025-69339 is a PHP Local File Inclusion (LFI) vulnerability in the don-themes Molla WordPress theme, caused by improper control of filenames used in PHP include/require statements. It affects all versions of the Molla theme up to and including 1.5.16. The vulnerability was published on March 5, 2026, and was assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High), exploitable remotely without authentication (Feedly, Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is insufficiently validated before being passed to PHP file inclusion functions (include/require). An unauthenticated remote attacker can manipulate the filename parameter to traverse the file system and include arbitrary local PHP files, potentially leading to code execution. The attack requires high complexity (AC:H), suggesting some preconditions such as specific server configurations or knowledge of file paths must be met (Feedly).

Successful exploitation allows an attacker to read sensitive local files — such as configuration files containing database credentials, API keys, or WordPress wp-config.php — and potentially execute arbitrary PHP code if writable or attacker-controlled files are present on the server. This can result in full confidentiality, integrity, and availability compromise of the affected WordPress installation, and may facilitate lateral movement within the hosting infrastructure (Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed in-the-wild exploitation of CVE-2025-69339. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

No official patch has been confirmed for the Molla theme beyond version 1.5.16 at the time of disclosure. Site administrators should update the Molla theme to any version newer than 1.5.16 as soon as a patched release becomes available. In the interim, disable PHP remote file inclusion by setting allow_url_include = Off in php.ini, implement strict input validation on all user-supplied parameters used in file operations, and deploy web application firewall (WAF) rules to detect and block LFI attack patterns. Monitoring server logs for unusual file access patterns is also recommended (Feedly, Patchstack).

Wordfence noted this vulnerability in their weekly WordPress vulnerability report covering the period of February 23 to March 1, 2026, highlighting it as part of a broader set of theme-level LFI issues. No significant additional vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified (Wordfence).