What is the CVSS score of CVE-2025-69106?

CVE-2025-69106 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Imba WordPress Theme are affected by CVE-2025-69106?

The Imba WordPress theme versions 1.5.0 and earlier (ThemeREX product) contain a remote file-inclusion vulnerability (CVE-2025-69106, CVSS 8.1) that enables unauthenticated attackers to read…

How to fix or mitigate CVE-2025-69106?

24 hours: Inventory WordPress installations using Imba theme via theme directory inspection (wp-content/themes/) or WordPress security scanner to identify all affected versions. 7 days: Remove Imba theme entirely and deploy an alternative WordPress-native theme; verify no theme references remain in WordPress database. 30 days: Establish communication with ThemeREX for patch timeline confirmation; if immediate remediation was not possible, implement WAF rules blocking file-inclusion patterns (directory traversal sequences, /etc/passwd requests, config file paths).

Imba WordPress Theme CVE-2025-69106

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Imba

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Unauthenticated network LFI (AV:N/PR:N/UI:N) with AC:H per advisory; full file read gives C:H, indirect I:L via log/secret abuse, no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:48 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions.

AnalysisAI

Local File Inclusion in the Imba WordPress theme versions 1.5.0 and earlier allows remote unauthenticated attackers to read arbitrary files from the underlying server. The flaw is rooted in PHP file-inclusion handling (CWE-98) and has no public exploit identified at time of analysis, but its unauthenticated network reachability makes it a notable risk for sites still running the affected ThemeREX product.

Technical ContextAI

Imba is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:imba). The vulnerability falls under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning a user-controllable value is passed into a PHP include/require call without adequate validation, allowing an attacker to coerce the application into loading attacker-chosen files. In WordPress themes this typically appears in custom AJAX handlers, template loaders, or 'view'/'page' parameters that resolve to filesystem paths.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory describes the issue against versions <= 1.5.0 without naming a fixed release, so administrators should monitor the ThemeREX vendor portal and the Patchstack entry (https://patchstack.com/database/wordpress/theme/imba/vulnerability/wordpress-imba-theme-1-5-0-local-file-inclusion-vulnerability) for an updated theme version and upgrade as soon as one is published. Until a fix is available, deploy a virtual patch via the Patchstack mitigation feed or a WAF rule that blocks requests containing path-traversal sequences (../, encoded variants, php://, file://) targeting theme endpoints, accepting that overly broad rules can break legitimate template parameters. As a stronger compensating control, restrict access to the affected theme's PHP entry points via webserver rules or temporarily switch to a different theme, recognising that this will alter site appearance and may affect dependent functionality.