Login Sign Up

CVE-2025-69076

8.1 HIGH

📋 TL;DR

This vulnerability allows attackers to include local files on the server through improper filename control in PHP include/require statements. It affects WordPress sites using the Modern Housewife theme version 1.0.12 and earlier. Attackers can potentially read sensitive files or execute arbitrary code.

💻 Affected Systems

Products:
  • AncoraThemes Modern Housewife WordPress Theme
Versions: n/a through <= 1.0.12
Operating Systems: Any OS running PHP
Default Config Vulnerable: ⚠️ Yes
Notes: Requires WordPress installation with vulnerable theme activated. PHP configuration with allow_url_include disabled does not prevent local file inclusion.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:
  1. Review the CVE details at NVD
  2. Check vendor security advisories for your specific version
  3. Test if the vulnerability is exploitable in your environment
  4. Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise through arbitrary code execution leading to data theft, ransomware deployment, or complete system takeover.

🟠

Likely Case

Sensitive file disclosure (configuration files, database credentials, user data) and limited code execution within web server context.

🟢

If Mitigated

Limited information disclosure if file permissions are properly configured and web server runs with minimal privileges.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Simple HTTP requests can trigger the vulnerability. Public exploit details available in security advisories.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.0.13 or later

Vendor Advisory: https://patchstack.com/database/Wordpress/Theme/modernhousewife/vulnerability/wordpress-modern-housewife-theme-1-0-12-local-file-inclusion-vulnerability?_s_id=cve

Restart Required: No

Instructions:

1. Update Modern Housewife theme to version 1.0.13 or later via WordPress admin panel. 2. Navigate to Appearance > Themes. 3. Click 'Update Now' for Modern Housewife theme. 4. Clear any caching plugins/CDN caches.

🔧 Temporary Workarounds

Disable vulnerable theme

all

Switch to a different WordPress theme until patch can be applied

Restrict PHP file functions

linux

Modify php.ini to disable dangerous functions

disable_functions = include,require,include_once,require_once

🧯 If You Can't Patch

  • Implement web application firewall (WAF) rules to block LFI patterns
  • Restrict web server permissions to minimal required directories

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Appearance > Themes for Modern Housewife version <= 1.0.12

Check Version:

grep -r 'Version:' /path/to/wordpress/wp-content/themes/modernhousewife/style.css

Verify Fix Applied:

Confirm theme version is 1.0.13 or later in WordPress admin

📡 Detection & Monitoring

Log Indicators:

  • Unusual file include patterns in PHP error logs
  • HTTP requests with file path traversal parameters

Network Indicators:

  • HTTP requests containing '../../' patterns or local file paths in parameters

SIEM Query:

source="web_logs" AND (uri="*..*" OR uri="*include*" OR uri="*require*") AND status=200

📊 Metadata

CVE ID: CVE-2025-69076
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-98
EPSS Score: 0.15% exploit probability (35.8th percentile)
Published: January 22, 2026
Last Updated: January 28, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-69076, you might also want to check these:

CVE-2025-25174 10.0

This CVE describes a PHP Local File Inclusion vulnerability in the BeeTeam368 Extensions WordPress p...

Same vulnerability type (CWE-98)
CVE-2025-49994 9.8

This vulnerability allows attackers to include local files on the server through improper filename c...

Same vulnerability type (CWE-98)
CVE-2025-50003 9.8

This vulnerability allows attackers to include local PHP files through improper filename control in ...

Same vulnerability type (CWE-98)