What is the CVSS score of CVE-2025-69107?

CVE-2025-69107 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Rosaleen WordPress Theme are affected by CVE-2025-69107?

The Rosaleen WordPress theme (versions 2.8 and earlier) contains a critical vulnerability enabling unauthenticated attackers to extract sensitive files and inject malicious content into any affected…

How to fix or mitigate CVE-2025-69107?

Within 24 hours: Identify all WordPress sites using Rosaleen theme versions 2.8 or earlier; disable the vulnerable theme and switch to an alternative immediately to prevent exploitation. Within 7 days: Configure PHP server settings (allow_url_include=Off); implement Web Application Firewall rules to block path traversal and file inclusion attack patterns; review access logs for evidence of exploitation attempts. Within 30 days: Complete security audit of all affected systems to identify compromised files or backdoors; implement file integrity monitoring; strengthen file system access controls and permissions.

Rosaleen WordPress Theme CVE-2025-69107

EUVD-2025-210190 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Rosaleen

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Unauthenticated network LFI (AV:N/PR:N/UI:N); AC:H reflects required non-default request shape; C:H for arbitrary file read, but I:L/A:L since escalation to RCE is conditional on additional PHP settings.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:05 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.

AnalysisAI

Unauthenticated remote local file inclusion in the Rosaleen WordPress theme versions 2.8 and earlier allows attackers to coerce the PHP application into including arbitrary files via a CWE-98 remote file inclusion/path traversal flaw. The issue was reported by Patchstack and affects the ThemeREX-developed Rosaleen theme; no public exploit identified at time of analysis, though the unauthenticated network vector makes opportunistic targeting plausible.

Technical ContextAI

Rosaleen is a commercial WordPress theme published by ThemeREX (CPE cpe:2.3:a:themerex:rosaleen). The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), which occurs when user-controllable input is concatenated into a PHP include(), require(), include_once(), or require_once() call without proper validation or path normalization. In WordPress themes, this pattern commonly appears in template loaders, AJAX handlers, or shortcode rendering routines that accept a 'file', 'template', or 'path' parameter. Successful exploitation typically lets the attacker read arbitrary local PHP/config files (e.g., wp-config.php) or, if allow_url_include is enabled or a writable upload path is reachable, execute attacker-controlled PHP code.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory does not list a fixed version in the provided data, and the EUVD range is open-ended at ≤2.8. Site operators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/rosaleen/vulnerability/wordpress-rosaleen-theme-2-8-local-file-inclusion-vulnerability) for the latest fix status and, in the interim, deploy a WAF rule (Patchstack, Wordfence, or equivalent) blocking path-traversal sequences (../, %2e%2e, php://, file://) against the theme's PHP entrypoints; restrict php.ini settings allow_url_include=Off and open_basedir to the WordPress root to limit blast radius; and, if the theme is non-essential, switch to an alternate theme until ThemeREX publishes a fixed release. The WAF approach may produce false positives on legitimate file-management plugins, and open_basedir can break plugins that legitimately read outside the webroot.