What is the CVSS score of CVE-2025-69105?

CVE-2025-69105 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Modernee Theme are affected by CVE-2025-69105?

The ThemeREX Modernee WordPress theme (versions 1.6.0 and earlier) contains an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that allows attackers to extract sensitive files and…

How to fix or mitigate CVE-2025-69105?

Within 24 hours: Audit all WordPress sites for active Modernee theme usage and check installed version. Within 7 days: Disable the vulnerable theme, switch to a patched alternative, or implement file access restrictions on wp-content/themes/modernee/. Within 30 days: Establish a vulnerability tracking process for premium WordPress themes and plan migration off custom or less-maintained themes.

Modernee Theme CVE-2025-69105

EUVD-2025-210189 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Modernee

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable LFI (AV:N/PR:N/UI:N); AC:H reflects required crafted request and path knowledge; full file disclosure plus log-poisoning RCE potential justifies C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:05 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the ThemeREX Modernee WordPress theme (versions through 1.6.0) allows remote attackers to coerce the server into including arbitrary local PHP files, enabling information disclosure and potential code execution via log poisoning or session file abuse. Reported by Patchstack and tracked as EUVD-2025-210189, no public exploit identified at time of analysis and the vulnerability is not in CISA KEV. The CVSS 8.1 score reflects high impact across confidentiality, integrity, and availability but with high attack complexity.

Technical ContextAI

Modernee is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:modernee). The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, aka 'PHP Remote File Inclusion'), meaning a PHP include/require statement uses attacker-influenced input without sufficient validation against path traversal or stream wrappers. In WordPress themes this typically manifests in template loaders, AJAX handlers, or admin-ajax endpoints that route a request parameter into include/require_once, allowing traversal sequences (../) or absolute paths to read sensitive files such as wp-config.php or to execute previously planted PHP content.

RemediationAI

No vendor-released patched version is independently confirmed in the available data, so administrators should monitor the ThemeREX Modernee theme changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/modernee/vulnerability/wordpress-modernee-theme-1-6-0-local-file-inclusion-vulnerability) for a fixed release beyond 1.6.0 and upgrade as soon as one is published. Until a patch is available, deploy a WAF rule (Patchstack vPatch, Wordfence, or equivalent) to block requests containing path traversal sequences (../, %2e%2e%2f) and PHP stream wrappers (php://, file://, data://) targeting Modernee theme endpoints; restrict PHP's open_basedir and set allow_url_include=Off and allow_url_fopen=Off in php.ini to limit traversal scope (side effect: may break legitimate plugins that rely on remote includes). As a temporary high-friction control, deactivate and switch away from the Modernee theme on production sites that handle sensitive data - accepting the visual/functional regression cost - and audit web logs for suspicious file= or template= style parameters consistent with LFI probing.