What is the CVSS score of CVE-2025-69110?

CVE-2025-69110 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of AirSupply are affected by CVE-2025-69110?

The AirSupply WordPress theme (versions ≤2.0.0) contains an unauthenticated local file inclusion vulnerability that could allow attackers to extract sensitive configuration files and database…

How to fix or mitigate CVE-2025-69110?

Within 24 hours: Audit all WordPress installations for AirSupply theme usage and either disable the theme or activate an alternative. Within 7 days: Deploy WAF rules blocking file inclusion attack patterns and enforce restrictive file permissions on the server to prevent PHP access to configuration files. Within 30 days: Monitor the Patchstack advisory and WordPress theme repository for vendor-released patches, then plan controlled updates to patched versions.

AirSupply CVE-2025-69110

EUVD-2025-210226 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Airsupply

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable PHP include with no auth or user interaction (AV:N/PR:N/UI:N); AC:H reflects required configuration/request conditions; LFI to RCE yields high C/I/A.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:43 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the AirSupply WordPress theme versions up to and including 2.0.0 allows remote attackers to coerce the PHP application into including arbitrary local files, exposing sensitive data and potentially leading to code execution. Reported by Patchstack and tracked under CWE-98 (improper PHP file inclusion), with no public exploit identified at time of analysis and no EPSS or KEV signal supplied in the input. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation that nevertheless requires meeting non-trivial conditions to succeed.

Technical ContextAI

AirSupply is a commercial WordPress theme distributed by ThemeRex, identified via cpe:2.3:a:themerex:airsupply. WordPress themes commonly expose PHP entry points (template loaders, AJAX handlers, or include helpers) that pass user-controlled path or template parameters into PHP include/require statements. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes exactly this class of bug: when the path passed to include()/require() is influenced by request input without strict allowlisting or normalization, an attacker can traverse the filesystem or, depending on PHP configuration (allow_url_include, log poisoning, session/upload paths), promote disclosure into code execution. The Patchstack advisory categorizes this as an LFI in the theme itself rather than a core WordPress flaw, meaning only sites running this specific theme are affected.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; the Patchstack advisory lists affected versions as <= 2.0.0 without a confirmed fixed release. Operators should check ThemeRex/ThemeForest for an AirSupply update newer than 2.0.0 and upgrade as soon as one is available, monitoring https://patchstack.com/database/wordpress/theme/air-supply/vulnerability/wordpress-airsupply-theme-2-0-0-local-file-inclusion-vulnerability for fix metadata. Until a patched version ships, compensating controls include deactivating the AirSupply theme and switching to a maintained alternative (highest assurance, but breaks site appearance), placing a WAF rule (Patchstack, Wordfence, or ModSecurity) in front of the site to block path-traversal sequences and suspicious file/template parameters on theme endpoints (may produce false positives on legitimate template loads), hardening PHP by setting allow_url_include=Off and open_basedir to the WordPress document root to limit which files can be read or executed (can break plugins that rely on broader filesystem access), and restricting filesystem permissions so the PHP user cannot read sensitive files like wp-config.php from outside expected paths.