CVE-2025-69068highCWE-98

CVE-2025-69068: high-severity vulnerability in AncoraThemes Muji

WordPress Muji theme <= 1.2.0 - Local File Inclusion vulnerability

Published · Updated

Follow this CVE+ Monitor Muji

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.6%
In short

The WordPress Muji theme up to version 1.2.0 has a flaw that allows attackers to include and execute files from the server, potentially exposing sensitive information or running malicious code.

Technical detail

A PHP Local File Inclusion (LFI) vulnerability exists in the Muji theme due to improper control of filenames in include/require statements. An attacker can manipulate input parameters to include arbitrary local files, leading to information disclosure or remote code execution depending on file accessibility and server configuration.

Summary generated and translated by AI from the official description.
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Muji muji allows PHP Local File Inclusion.This issue affects Muji: from n/a through <= 1.2.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
AncoraThemes · Muji