Improper Control of Filename in XpeedStudio Bajaar WooCommerce Theme
CVE-2025-69004

8.1HIGH

Key Information:

Vendor

WordPress
Status
Bajaar - Highly Customizable WooCommerce WordPress Theme
Vendor
CVE Published:
22 January 2026

What is CVE-2025-69004?

The Bajaar theme, developed by XpeedStudio, contains a vulnerability due to improper control over the filename in PHP's include and require statements. This flaw allows for PHP Local File Inclusion, which could potentially enable an attacker to access sensitive files on the server. Affected versions include all versions up to and including 2.1.0. Website administrators using this theme should apply necessary patches or updates to mitigate the risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Bajaar - Highly Customizable WooCommerce WordPress Theme <= n/a

References

https://patchstack.com/database/Wordpress/Theme/bajaar/vu...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
JSON
.