CVE-2025-69164
Deferred Deferred - Pending Action
BaseFortify

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69164
EUVD
EUVD-2025-210264
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
skyward skyward to 1.10 (inc)
patchstack skyward to 1.10 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69164 is a Local File Inclusion (LFI) vulnerability found in the WordPress Skyward Theme versions 1.10 and below. This vulnerability allows unauthenticated attackers to include local files from the target website's server. By exploiting this flaw, attackers can potentially access sensitive information stored in these files, such as database credentials.

Impact Analysis

This vulnerability can have severe impacts including exposure of sensitive data like database credentials. Depending on the server configuration, it may lead to a full database takeover. The vulnerability has a high severity score (CVSS 8.1), indicating a high likelihood of exploitation, which could result in significant data breaches and compromise of the affected website.

Since the vulnerability is unauthenticated, attackers do not need any credentials to exploit it, increasing the risk of widespread attacks.

Currently, there is no official patch available, but mitigation rules exist to block attacks temporarily. Immediate action such as updating the theme or applying mitigations is strongly advised.

Mitigation Strategies

Immediate actions include updating the Skyward theme to a version above 1.10 if available, or seeking assistance from your hosting provider or developer.

Since there is no official patch yet, Patchstack has issued a mitigation rule to block attacks targeting this vulnerability.

You can also use automated mitigation solutions provided by Patchstack to protect your website until an official fix is released.

Compliance Impact

The vulnerability allows unauthenticated attackers to include local files on the target website, potentially exposing sensitive data such as database credentials and enabling a full database takeover depending on server configuration.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, organizations using affected versions of the Skyward theme may face increased risk of violating these standards if the vulnerability is exploited.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart