What is the CVSS score of CVE-2025-69112?

CVE-2025-69112 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Planty WordPress Theme are affected by CVE-2025-69112?

The Planty WordPress theme (versions 1.14.0 and earlier) contains an unauthenticated file inclusion vulnerability that allows attackers to exfiltrate sensitive configuration data and execute…

How to fix or mitigate CVE-2025-69112?

24 hours: Audit all WordPress instances for Planty theme deployment (v1.14.0 and earlier) and record affected URLs. 7 days: Disable or replace the theme with alternatives; implement WAF rules blocking common file inclusion patterns (e.g., php:// and file:// requests). 30 days: Monitor Patchstack advisory EUVD-2025-210193 for official patch release and plan immediate deployment once available.

Planty WordPress Theme CVE-2025-69112

EUVD-2025-210193 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Planty

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable LFI in a PHP theme (AV:N/PR:N/UI:N); AC:H reflects undisclosed exploitation preconditions; LFI to wp-config and potential RCE yields C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:03 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the Planty WordPress theme versions 1.14.0 and earlier allows remote attackers to coerce the PHP application into including arbitrary files from the server filesystem, leading to disclosure of sensitive configuration data and potential code execution. The flaw is reachable without credentials over the network but rated AC:H, indicating exploitation requires meeting specific conditions; no public exploit identified at time of analysis and the issue is tracked by Patchstack and ENISA EUVD-2025-210193.

Technical ContextAI

Planty is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:planty), commonly deployed on plant-shop and gardening WordPress sites. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), where user-controlled input is passed into a PHP include/require construct without proper validation or path canonicalization. In WordPress themes, this pattern typically arises from AJAX endpoints, template loaders, or shortcode handlers that accept a file or template name parameter and concatenate it into an include() call, allowing path traversal sequences or absolute paths to redirect inclusion to unintended files such as wp-config.php or PHP wrappers.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - the Patchstack advisory does not list a fixed version in the inputs available, so administrators should monitor the ThemeREX vendor changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/planty/vulnerability/wordpress-planty-theme-1-14-0-local-file-inclusion-vulnerability) for an updated Planty release above 1.14.0 and upgrade immediately when published. Until a patched theme version is available, compensating controls include deploying a WordPress-aware WAF rule (Patchstack, Wordfence, or ModSecurity CRS) to block requests containing path traversal sequences (../, php://, file://, data://) targeting Planty theme endpoints under /wp-content/themes/planty/, disabling the allow_url_include PHP directive and restricting open_basedir to the WordPress document root to limit which files PHP can include, and temporarily deactivating the Planty theme on high-value sites if a maintenance theme is acceptable - noting that WAF rules can be bypassed via encoding and that deactivating the theme will break site presentation.