What is the CVSS score of CVE-2025-69109?

CVE-2025-69109 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Raider Spirit are affected by CVE-2025-69109?

The ThemeREX Raider Spirit WordPress theme through version 1.1.2 contains a critical file inclusion flaw that permits unauthenticated attackers to read sensitive files and potentially execute…

How to fix or mitigate CVE-2025-69109?

24 hours: Inventory all WordPress installations for ThemeREX Raider Spirit versions ≤1.1.2; immediately deactivate and uninstall the theme. 7 days: Deploy an alternative theme verified as secure; scan systems for exploitation artifacts and conduct unauthorized file access log review. 30 days: Implement WAF (Web Application Firewall) rules to block path traversal sequences (../ patterns and encoded variants); harden PHP configuration to restrict include_path to whitelisted directories only.

Raider Spirit CVE-2025-69109

EUVD-2025-210192 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Raider Spirit

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Unauthenticated network reach (AV:N/PR:N/UI:N), AC:H reflects non-trivial path-bypass precondition; LFI primarily discloses files (C:H), with I:L/A:L since direct write or DoS via inclusion is secondary.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:04 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.

AnalysisAI

Local File Inclusion in the ThemeREX Raider Spirit WordPress theme versions 1.1.2 and earlier allows unauthenticated remote attackers to include and disclose arbitrary local files via attacker-controlled file paths reaching a PHP include/require sink. The flaw maps to CWE-98 (Improper Control of Filename for Include/Require) and was disclosed through Patchstack with no public exploit identified at time of analysis, though the CVSS 8.1 rating reflects high confidentiality, integrity, and availability impact if the inclusion can be steered to executable PHP content.

Technical ContextAI

The affected component is the Raider Spirit commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:raider_spirit). CWE-98 covers PHP-specific file inclusion bugs where externally influenced input flows into include(), require(), include_once(), or require_once() without sufficient path canonicalization or allow-list validation. In WordPress themes, this typically arises from AJAX handlers, template-loader shortcodes, or admin-ajax endpoints that accept a parameter naming a partial template, then concatenate it into an include call - letting an attacker traverse with ../ sequences or supply absolute paths to read wp-config.php and other sensitive PHP, or, if log poisoning or upload primitives exist, to execute attacker-controlled PHP.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory lists versions <=1.1.2 as affected without naming a fixed release, so administrators should monitor the ThemeREX changelog and the Patchstack page (https://patchstack.com/database/wordpress/theme/raiderspirit/vulnerability/wordpress-raider-spirit-theme-1-1-2-local-file-inclusion-vulnerability) for a 1.1.3+ update and apply it immediately when published. As compensating controls, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity CRS 932160/930100 family) to block traversal sequences and absolute paths in theme AJAX/template parameters; restrict access to the theme's PHP endpoints via .htaccess or nginx location blocks until patched; rotate WordPress salts and database credentials assuming wp-config.php may already be disclosed; and as a last resort deactivate and replace the theme, accepting the visual/site-design impact. Avoid relying on open_basedir alone since LFI within the document root still reads wp-config.php.