CVE-2025-69369

Vulnerability

An Improper Control of Filename for Include/Require Statement in PHP Program, also known as PHP Remote File Inclusion, vulnerability exists in Axiomthemes Racquet theme. This issue allows for PHP Local File Inclusion and affects versions from n/a through 1.12.0 [1].

Exploitation

An attacker can exploit this vulnerability by including local files of the target website. The specific conditions or required user interaction for exploitation are not detailed in the available references, but it is noted that such vulnerabilities are often used in mass-exploit campaigns [1].

Impact

Successful exploitation allows a malicious actor to include local files and display their content. This could lead to the disclosure of sensitive information, such as database credentials, potentially resulting in a complete database takeover depending on the server's configuration [1].

Mitigation

The affected versions are up to and including 1.12.0. Updating to a version later than 1.12.0 is recommended. If an immediate update is not possible, users are advised to seek assistance from their hosting provider or web developer [1].