CVE-2025-69369
PHP Local File Inclusion in Axiomthemes Racquet
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| axiomthemes | racquet | From 1.0.0 (inc) to 1.12.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69369 is a Local File Inclusion (LFI) vulnerability in the WordPress Racquet Theme versions 1.12.0 and below. It allows unauthenticated attackers to include local files from the target website by exploiting improper control of filename parameters in PHP include or require statements.
This flaw can lead to exposure of sensitive data such as database credentials, depending on the server configuration.
How can this vulnerability impact me? :
The vulnerability can have severe impacts including unauthorized access to sensitive files on the server.
- Exposure of sensitive data such as database credentials.
- Potential complete database takeover depending on server configuration.
- High risk of exploitation as indicated by the CVSS score of 8.1.
It is expected to be targeted in mass-exploit campaigns, increasing the urgency to mitigate or patch the vulnerability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves Local File Inclusion (LFI) in the WordPress Racquet Theme, which can be detected by monitoring for suspicious HTTP requests attempting to include local files via PHP include/require statements.
You can detect potential exploitation attempts by searching web server logs for unusual URL parameters that reference local files or directory traversal patterns.
- Use grep or similar tools to search access logs for suspicious patterns, for example: grep -iE "(\.|%2e){2,}/" /var/log/apache2/access.log
- Look for requests containing PHP file inclusion attempts, such as: grep -i "include" /var/log/apache2/access.log
- Monitor for unexpected file reads or errors in PHP error logs that may indicate attempted exploitation.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the Patchstack mitigation rule to block attacks targeting this vulnerability until an official patch is released.
If possible, update the WordPress Racquet Theme to a version higher than 1.12.0 once it becomes available.
Seek assistance from your hosting provider or a web developer to implement temporary protections such as web application firewall (WAF) rules or disabling vulnerable theme features.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The Local File Inclusion (LFI) vulnerability in the WordPress Racquet Theme can lead to unauthorized access to sensitive data such as database credentials. This exposure could result in a complete database takeover depending on server configuration.
Such unauthorized access and potential data breaches can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding sensitive personal and health information against unauthorized access and disclosure.
Failure to address this vulnerability may lead to violations of these standards due to compromised confidentiality, integrity, and availability of protected data.