CVE-2025-69369: Axiomthemes Racquet LFI Vulnerability

CVE-2025-69369 Overview

CVE-2025-69369 is a PHP Local File Inclusion (LFI) vulnerability in the Axiomthemes Racquet WordPress theme. The flaw stems from improper control of filenames used in PHP include/require statements [CWE-98]. Attackers can manipulate file path parameters to load arbitrary local files through the web server. All versions of Racquet up to and including 1.12.0 are affected. The vulnerability carries a CVSS 3.1 score of 8.1 and impacts confidentiality, integrity, and availability. Successful exploitation can expose sensitive configuration files such as wp-config.php, leak credentials, and in chained scenarios enable code execution on the WordPress host.

Critical Impact
Unauthenticated network attackers can include arbitrary local PHP files, potentially exposing WordPress secrets and enabling further compromise of the host.

Affected Products

Axiomthemes Racquet WordPress Theme — versions through 1.12.0
WordPress sites running the vulnerable theme on any PHP runtime
Any hosting environment serving the Racquet theme files

Discovery Timeline

2026-06-02 - CVE-2025-69369 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2025-69369

Vulnerability Analysis

The Racquet theme passes attacker-controllable input into a PHP include or require statement without normalizing or whitelisting the resolved path. This is a classic Local File Inclusion pattern tracked under [CWE-98]. An unauthenticated attacker crafts an HTTP request containing a manipulated filename parameter. The PHP interpreter then loads and executes the referenced file in the context of the WordPress process. Because PHP evaluates included files as code, any PHP source on disk becomes executable through the inclusion sink. Static assets such as logs, uploaded media, or session files can also be read or interpreted depending on path traversal handling.

Root Cause

The root cause is missing input validation on a filename parameter that flows into a dynamic file inclusion call. The theme does not enforce an allow-list of permitted templates, does not constrain the path to a fixed directory, and does not strip traversal sequences such as ../. PHP resolves the supplied path against the filesystem, allowing references outside the intended theme directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker issues an HTTP request to a vulnerable theme endpoint and supplies a crafted filename value. The request causes the server to include a target file such as wp-config.php, system files readable by the web server user, or previously uploaded PHP content. Combined with file upload primitives elsewhere in WordPress, the LFI can be promoted to remote code execution.

The vulnerability mechanism is described in the Patchstack Theme Vulnerability Analysis. No verified public exploit code is published at this time.

Detection Methods for CVE-2025-69369

Indicators of Compromise

HTTP requests to Racquet theme PHP endpoints containing path traversal sequences such as ../, encoded variants %2e%2e%2f, or absolute paths like /etc/passwd.
Web server access logs showing query parameters referencing wp-config.php, php://filter, or php://input.
Unexpected PHP errors referencing include() or require() failures for files outside the theme directory.

Detection Strategies

Inspect WordPress and reverse proxy logs for requests targeting theme files with file path parameters and traversal patterns.
Deploy web application firewall (WAF) rules that block LFI payloads and PHP wrapper schemes against theme endpoints.
Monitor PHP-FPM and Apache/Nginx logs for failed to open stream or No such file or directory errors tied to include statements.

Monitoring Recommendations

Alert on outbound reads of wp-config.php and database credential disclosures through application telemetry.
Track file inclusion attempts and correlate with subsequent administrative logins or new PHP files appearing in wp-content/uploads.
Baseline normal theme parameters and flag deviations involving file extensions, traversal characters, or URL-encoded path tokens.

How to Mitigate CVE-2025-69369

Immediate Actions Required

Disable or remove the Racquet theme on sites running version 1.12.0 or earlier until a fixed release is installed.
Restrict access to theme PHP files through WAF rules that block path traversal and PHP stream wrappers.
Rotate WordPress secrets in wp-config.php, database credentials, and any API keys reachable from the web root if exploitation is suspected.

Patch Information

No vendor-confirmed fixed version is referenced in the NVD entry at publication. Site owners should monitor the Patchstack Theme Vulnerability Analysis and the Axiomthemes vendor channel for an updated Racquet release beyond 1.12.0.

Workarounds

Configure PHP with open_basedir restrictions to confine includes to the WordPress installation directory.
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent remote inclusion escalation.
Apply virtual patching at the WAF layer to block requests containing ../, php://, file://, and data:// in query parameters targeting theme paths.

bash

# Configuration example - php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"