CVE-2025-69163
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in WineShop

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69163
EUVD
EUVD-2025-210178
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack wineshop to 3.17 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69163 is a high-priority Local File Inclusion (LFI) vulnerability found in the WordPress WineShop Theme versions 3.17 and below.

This flaw allows an unauthenticated attacker to include local files on the target website, which can lead to exposure of sensitive information such as database credentials.

The vulnerability has a CVSS score of 8.1, indicating a high risk, and it can potentially lead to a full database takeover.

Impact Analysis

Exploitation of this vulnerability can result in unauthorized access to sensitive data, including database credentials.

An attacker could leverage this to take over the entire database, compromising the integrity, confidentiality, and availability of your data.

Since the vulnerability is unauthenticated and actively dangerous, it may be targeted in mass-exploit campaigns, increasing the risk of widespread attacks.

There is currently no official patch, so immediate mitigation steps such as applying provided rules or updating the theme are strongly advised.

Mitigation Strategies

The WineShop WordPress theme versions 3.17 and below are vulnerable to a high-priority Local File Inclusion (LFI) flaw that can be exploited by unauthenticated attackers.

Immediate mitigation steps include updating the theme to a non-vulnerable version if available, or applying the mitigation rule provided by Patchstack to block attacks until an official fix is released.

If updating is not possible, seek assistance from your hosting provider or a developer to implement protective measures.

Compliance Impact

The vulnerability allows unauthenticated attackers to include local files on the target website, potentially exposing sensitive data such as database credentials and enabling full database takeover.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, if exploited, this vulnerability may result in violations of these standards by compromising confidentiality, integrity, and availability of protected data.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69163. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart