CVE-2025-69159
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in Printo

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Printo <= 1.11 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69159
EUVD
EUVD-2025-210175
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack printo to 1.11 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69159 is a Local File Inclusion (LFI) vulnerability found in the WordPress Printo Theme versions 1.11 and below.

This vulnerability allows unauthenticated attackers to include local files on the target website, which can lead to exposure of sensitive data such as database credentials.

Depending on the server configuration, this could result in a complete database takeover.

Impact Analysis

The impact of this vulnerability is high risk, with a CVSS score of 8.1.

  • Exposure of sensitive data such as database credentials.
  • Potential complete takeover of the database depending on server configuration.
  • Websites using the vulnerable theme may be targeted in mass-exploitation campaigns.
Mitigation Strategies

The vulnerability affects the WordPress Printo Theme versions 1.11 and below and allows unauthenticated attackers to include local files, potentially exposing sensitive data.

Since there is no official patch available yet, immediate mitigation steps include applying the Patchstack mitigation rule to block attacks until an official fix is released.

Other recommended actions are to update the theme when a patch becomes available or seek assistance from a hosting provider or web developer.

Patchstack also offers automated vulnerability mitigation services to help keep websites secure.

Compliance Impact

This vulnerability allows unauthenticated attackers to include local files on the target website, potentially exposing sensitive data such as database credentials. Exposure of such sensitive information could lead to a complete database takeover depending on the server configuration.

The potential exposure and compromise of sensitive data could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information.

Immediate mitigation and patching are advised to prevent data breaches that could result in regulatory non-compliance.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart