The vulnerability CVE-2025-69061 affects the AncoraThemes MoveMe plugin (versions up to 1.2.15) and is characterized by improper control over the filename parameter in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can cause the application to include unintended local files, potentially executing arbitrary code or disclosing sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability does not require user interaction and can be exploited remotely over the network, but requires high attack complexity and no privileges.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary local files on the server running the MoveMe plugin, leading to full compromise of the system's confidentiality, integrity, and availability. This could result in unauthorized data disclosure, code execution, and denial of service. The CVSS vector indicates no privileges or user interaction are needed, but the attack complexity is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the AncoraThemes vendor advisories for updates. Until a fix is available, consider restricting access to the vulnerable plugin and applying web application firewall (WAF) rules to detect and block suspicious include/require requests if feasible.