CVE-2025-69118: WordPress CopyPress theme <= 1.4.5 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
wordpress/copypressfrom your environment.Uninstall/delete the CopyPress theme from the site (Appearance → Themes → Delete) or remove its files from wp-content/themes/copypress if the theme is not required.
- Configuration
Deactivate the CopyPress theme in the WordPress admin (Appearance → Themes). If admin access is not available, disable the theme by renaming or removing the theme directory (wp-content/themes/copypress) on the filesystem.
WordPress CopyPress theme active = disabled - Compensating control
If immediate removal/upgrade is not possible, deploy WAF rules or web server filters to block Local File Inclusion payloads and restrict public access to theme file endpoints (and other sensitive files). Limit access to management endpoints to trusted IPs.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69118?
CVE-2025-69118 has a severity rating of 8.1, indicating a high-risk vulnerability.
How do I fix CVE-2025-69118?
To fix CVE-2025-69118, update the CopyPress WordPress theme to version 1.4.6 or later.
What type of vulnerability is CVE-2025-69118?
CVE-2025-69118 is classified as a Local File Inclusion vulnerability.
Who is affected by CVE-2025-69118?
All users of CopyPress WordPress theme versions 1.4.5 and earlier are affected by CVE-2025-69118.
What are the potential risks of CVE-2025-69118?
CVE-2025-69118 could allow an unauthenticated attacker to include local files on the server, leading to exposure of sensitive information.