CVE-2025-69162
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in Grecko

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69162
EUVD
EUVD-2025-210177
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack grecko to 5.17 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69162 is a Local File Inclusion (LFI) vulnerability found in the WordPress Grecko Theme versions 5.17 and below.

This vulnerability allows an attacker to include local files on the target website without needing any authentication or special privileges.

Exploiting this flaw could expose sensitive data such as database credentials and potentially lead to a full database takeover.

Impact Analysis

The impact of this vulnerability is high due to its CVSS score of 8.1.

An attacker can exploit the vulnerability without authentication to access local files on your website.

This can lead to exposure of sensitive information such as database credentials, which may result in a full database takeover.

Such a compromise can severely affect the confidentiality, integrity, and availability of your website and its data.

Mitigation Strategies

The WordPress Grecko Theme versions 5.17 and below are vulnerable to an unauthenticated Local File Inclusion (LFI) flaw that can lead to exposure of sensitive data and full database takeover.

Since there is no official patch available yet, immediate mitigation steps include applying the Patchstack mitigation rule to block attacks targeting this vulnerability.

Additionally, it is advised to update the theme as soon as an official fix is released or seek assistance from your hosting provider or a developer to implement protective measures.

Compliance Impact

The vulnerability allows unauthenticated attackers to include local files on the target website, potentially exposing sensitive data such as database credentials and enabling a full database takeover.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, exploitation of this vulnerability may result in violations of these common standards and regulations by compromising confidentiality, integrity, and availability of protected data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart