CVE-2025-69072
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ancorathemes | prider | to 1.1.3.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69072 is a Local File Inclusion (LFI) vulnerability in the WordPress Prider Theme versions up to 1.1.3.1. It allows an unauthenticated attacker to include and display local files from the target website's server. This means the attacker can read sensitive files on the server, such as configuration or database credential files, by exploiting improper control of filename inputs in the theme's PHP code. [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including exposure of sensitive information like database credentials. An attacker exploiting this flaw could potentially take over the website's database depending on the server configuration. Since the vulnerability requires no authentication, it poses a high risk of exploitation and can lead to significant data breaches and loss of control over the affected website. [1]
What immediate steps should I take to mitigate this vulnerability?
Apply the mitigation rule provided by Patchstack to block attacks targeting this vulnerability until an official patch is released. Immediate implementation of this rule is strongly recommended to protect your website from exploitation. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated attackers to access and display local files on the server, potentially exposing sensitive information such as database credentials. Such exposure of sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access. Therefore, exploitation of this vulnerability could result in violations of these standards due to compromised data confidentiality. [1]