What is the CVSS score of CVE-2025-69005?

CVE-2025-69005 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-69005?

A critical file inclusion vulnerability in the Search & Go WordPress plugin (versions ≤ 2.8) allows attackers to read sensitive files from affected servers, potentially exposing credentials,…

How to fix or mitigate CVE-2025-69005?

Within 24 hours: Identify all installations of Search & Go plugin and assess if version ≤ 2.8 is deployed; immediately disable or deactivate the plugin if confirmed. Within 7 days: Implement WAF rules to block suspicious file inclusion patterns targeting the vulnerable plugin; review access logs for indicators of exploitation. Within 30 days: Either upgrade to a patched version when available (monitor vendor communications) or replace the plugin with a secure alternative search solution.

PHP CVE-2025-69005

HIGH

PHP Remote File Inclusion (CWE-98)

2026-01-22 audit@patchstack.com

PHP Golang LFI

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 8.1

DescriptionNVD

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Search & Go search-and-go allows PHP Local File Inclusion.This issue affects Search & Go: from n/a through <= 2.8.

AnalysisAI

Technical ContextAI

Classified as CWE-98 (PHP Remote File Inclusion). Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Search & Go search-and-go allows PHP Local File Inclusion.This issue affects Search & Go: from n/a through <= 2.8.

Affected ProductsAI

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Search & Go sea

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

CVE-2025-69005 vulnerability details – vuln.today

Back

PHP CVE-2025-69005

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Share

External POC / Exploit Code