Login Sign Up

CVE-2025-69047

8.1 HIGH

📋 TL;DR

This CVE describes a PHP Local File Inclusion vulnerability in the MaxShop WordPress theme. Attackers can include arbitrary local files through improper filename control in PHP include/require statements, potentially leading to sensitive information disclosure or code execution. All WordPress sites using MaxShop theme versions up to and including 3.6.20 are affected.

💻 Affected Systems

Products:
  • magentech MaxShop WordPress theme
Versions: n/a through <= 3.6.20
Operating Systems: Any OS running PHP
Default Config Vulnerable: ⚠️ Yes
Notes: Requires WordPress installation with MaxShop theme active. Vulnerability exists in theme code, not core WordPress.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data exfiltration, and persistent backdoor installation.

🟠

Likely Case

Sensitive file disclosure (configuration files, database credentials, source code) and limited code execution within web server context.

🟢

If Mitigated

Information disclosure limited to publicly accessible files if proper file permissions and web server configurations are in place.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Simple HTTP requests can trigger the vulnerability. Public exploit details available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 3.6.20

Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/sw_maxshop/vulnerability/wordpress-maxshop-theme-3-6-20-local-file-inclusion-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Update MaxShop theme to latest version via WordPress admin panel. 2. If auto-update unavailable, download latest version from official source. 3. Replace theme files manually via FTP/SFTP. 4. Clear WordPress cache if applicable.

🔧 Temporary Workarounds

Disable vulnerable theme

all

Switch to default WordPress theme to immediately mitigate risk

wp theme activate twentytwentyfour
wp theme deactivate sw_maxshop

Web Application Firewall rule

linux

Block requests containing local file inclusion patterns

ModSecurity rule: SecRule ARGS "\.\./" "id:1001,phase:2,deny,status:403,msg:'Local File Inclusion attempt'

🧯 If You Can't Patch

  • Implement strict file permissions (chmod 644 for files, 755 for directories)
  • Deploy web application firewall with LFI detection rules

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Appearance > Themes for MaxShop version. If version <= 3.6.20, vulnerable.

Check Version:

wp theme list --name=sw_maxshop --field=version

Verify Fix Applied:

Confirm MaxShop theme version > 3.6.20 in WordPress admin. Test with known LFI payloads to verify blocking.

📡 Detection & Monitoring

Log Indicators:

  • HTTP requests with ../ patterns in parameters
  • PHP include/require errors in web server logs
  • Access to sensitive files like /etc/passwd in access logs

Network Indicators:

  • HTTP GET/POST requests with file path traversal sequences
  • Unusual file extensions in URL parameters

SIEM Query:

source="web_access.log" AND ("../" OR "..\" OR "/etc/" OR "/proc/") AND status=200

📊 Metadata

CVE ID: CVE-2025-69047
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-98
EPSS Score: 0.15% exploit probability (35.8th percentile)
Published: January 22, 2026
Last Updated: January 29, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-69047, you might also want to check these:

CVE-2025-25174 10.0

This CVE describes a PHP Local File Inclusion vulnerability in the BeeTeam368 Extensions WordPress p...

Same vulnerability type (CWE-98)
CVE-2025-49994 9.8

This vulnerability allows attackers to include local files on the server through improper filename c...

Same vulnerability type (CWE-98)
CVE-2025-50003 9.8

This vulnerability allows attackers to include local PHP files through improper filename control in ...

Same vulnerability type (CWE-98)