CVE-2025-69044
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-01-28

Assigner: Patchstack

Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Vango vango allows PHP Local File Inclusion.This issue affects Vango: from n/a through <= 1.3.3.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-01-28
Generated
2026-06-16
AI Q&A
2026-01-22
EPSS Evaluated
2026-06-14
NVD
CVE-2025-69044
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
goalthemes vango From 1.0 (inc) to 1.3.3 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

This vulnerability allows unauthenticated attackers to access and display local files, potentially exposing sensitive information such as database credentials. Such exposure could lead to data breaches involving personal or protected health information, thereby negatively impacting compliance with standards like GDPR and HIPAA that require protection of sensitive data. However, no specific compliance impact details are provided in the resources. [1]

Executive Summary

CVE-2025-69044 is a Local File Inclusion (LFI) vulnerability in the WordPress Vango Theme (versions up to 1.3.3). It allows an unauthenticated attacker to include and display local files from the target website. This means the attacker can access sensitive files on the server, such as configuration files or database credentials, by exploiting improper control of filename input in PHP include/require statements. [1]

Impact Analysis

This vulnerability can have severe impacts including exposure of sensitive information like database credentials. Exploitation could lead to a complete database takeover depending on the website's configuration. Since it requires no privileges to exploit, any attacker can potentially compromise the website, leading to data breaches and loss of control over the database. [1]

Detection Guidance

Detection can involve monitoring web server logs for suspicious requests attempting to include local files via the vulnerable theme. Specific commands are not provided in the resources, but generally, searching access logs for patterns like requests containing 'include' or attempts to access sensitive files (e.g., /etc/passwd) may help identify exploitation attempts. [1]

Mitigation Strategies

Since no official patch is available, immediate mitigation involves applying the Patchstack mitigation rule designed to block attacks targeting this vulnerability. Users are strongly advised to implement this mitigation to protect their sites until an official fix is released. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart