AirSupply CVE-2025-69110

Exploitation requires a public-facing WordPress site with the AirSupply (ThemeRex) theme installed and active at version 2.0.0 or earlier, and the attacker must reach the specific vulnerable theme PHP endpoint that performs the include - no WordPress user account is needed (PR:N). Limiting factors reflected in AC:H include needing the right request shape against the vulnerable include sink and a PHP/WordPress configuration that does not block traversal or path normalization; promotion from file read to RCE additionally depends on PHP settings (allow_url_include, available log/upload paths) and the web server user being able to read sensitive files such as wp-config.php. Sites not running AirSupply, or running a fixed version once published, are not exploitable via this CVE.

Signals point to a real but conditional risk. CVSS 3.1 of 8.1 is driven by network reach, no authentication, and high impact across C/I/A - consistent with an LFI that can read secrets (wp-config.php) and pivot to RCE. AC:H is notable: NVD/Patchstack judged that successful exploitation depends on conditions beyond the attacker's control (likely specific request shape, theme configuration, or PHP settings), which tempers the raw 8.1. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of mass exploitation; absence of those signals is not proof of safety, especially for a Patchstack-tracked WordPress theme bug where exploitation tooling often emerges shortly after disclosure. Net assessment: prioritize for any site running AirSupply <= 2.0.0, but it is not on par with KEV-listed mass-exploitation WordPress flaws.

An unauthenticated attacker sends a crafted HTTP(S) request to a public WordPress site running the AirSupply theme, targeting a theme PHP endpoint that takes a file or template parameter and feeds it into include()/require(). By supplying a traversal payload (or an absolute path), the attacker reads wp-config.php to harvest database credentials and secret keys, then pivots - for example by poisoning a log or uploading PHP via the disclosed credentials - to full remote code execution under the web server account. No public exploit was identified at time of analysis, but CWE-98 LFI patterns in WordPress themes are routinely weaponized once advisory details circulate.