The vulnerability CVE-2025-69070 affects AncoraThemes Tornados versions up to 2.1 and arises from improper validation or control of filenames used in PHP include or require statements. This can lead to PHP Local File Inclusion, where an attacker might cause the application to include unintended local files, potentially exposing sensitive information or enabling code execution. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to include and execute arbitrary local files on the server running AncoraThemes Tornados, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized data disclosure, modification, or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable endpoints, applying web application firewall rules to detect and block suspicious include/require requests, and monitoring for unusual file access patterns related to the Tornados application.