CVE-2025-69171
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in Orpheus

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69171
EUVD
EUVD-2025-210234
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack orpheus to 1.3 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69171 is a Local File Inclusion (LFI) vulnerability found in the WordPress Orpheus Theme versions 1.3 and below.

This vulnerability allows an unauthenticated attacker to include local files on the target website.

Exploitation can lead to exposure of sensitive data such as database credentials and potentially a full database takeover.

No special privileges or authentication are required to exploit this vulnerability.

Impact Analysis

This vulnerability poses a high risk as it can lead to unauthorized access to sensitive information on your website.

  • Exposure of sensitive data like database credentials.
  • Potential full database takeover.
  • It can be exploited without any authentication, increasing the risk of mass exploitation.

Immediate action is advised, such as updating the theme or applying mitigation rules to block attacks.

Mitigation Strategies

The WordPress Orpheus Theme versions 1.3 and below have a high-priority Local File Inclusion vulnerability that requires immediate mitigation.

  • Update the Orpheus theme to a version above 1.3 if available.
  • Apply the mitigation rule issued by Patchstack to block attacks until an official patch is released.
  • Seek assistance from your hosting provider or a developer to implement protective measures.
Compliance Impact

The vulnerability allows attackers to include local files on the target website, potentially exposing sensitive data such as database credentials and enabling a full database takeover.

Exposure of sensitive data can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and health information against unauthorized access.

Because the vulnerability is unauthenticated and has a high severity score, it poses a significant risk of data breaches, which could result in non-compliance with these standards.

Immediate mitigation or patching is advised to reduce the risk of exploitation and help maintain compliance with relevant data protection regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69171. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart