Imba WordPress Theme CVE-2025-69106

Target site must have the ThemeREX Imba WordPress theme version 1.5.0 or earlier installed and active, with the vulnerable file-inclusion endpoint reachable over HTTP/HTTPS from the attacker. No authentication or user interaction is required (PR:N/UI:N), but the CVSS AC:H rating indicates the attacker must satisfy non-trivial preconditions - likely crafting a specific parameter format, encoding, or environment-dependent path - to coerce the include into resolving to a useful target file. Exploitation is further limited by standard PHP/server hardening such as open_basedir restrictions, allow_url_include=Off, and filesystem permissions that determine which files the web server process can actually read.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N indicates remote, unauthenticated exploitation with high attack complexity, yielding an 8.1 score with H/H/H impacts - likely reflecting that successful LFI can be chained to source disclosure, secret theft, and potential code execution via log/session poisoning. AC:H suggests non-trivial preconditions (e.g., specific request shaping or environmental factors), which tempers urgency. There is no KEV listing and no public POC identified, and no EPSS score was supplied, so real-world exploitation pressure is currently unconfirmed; nonetheless, unauthenticated LFI in a WordPress theme is a well-understood attacker target and should be treated as a real priority for any site still running Imba <= 1.5.0.

An unauthenticated attacker on the internet sends a crafted HTTP request to a vulnerable Imba theme endpoint with a manipulated parameter that controls a PHP include path, retrieving wp-config.php to harvest database credentials and WordPress secret keys. With those secrets the attacker can pivot to authenticated site takeover or attempt code execution by including poisoned log files or uploaded content. No public exploit identified at time of analysis, but the technique is well documented for WordPress LFI flaws.