What is the CVSS score of CVE-2025-69115?

CVE-2025-69115 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of LuxMed WordPress Theme are affected by CVE-2025-69115?

The ThemeREX LuxMed Medicine & Healthcare Doctor WordPress theme (versions 1.2.2 and earlier) contains an unauthenticated remote file inclusion vulnerability that could allow attackers to execute…

How to fix or mitigate CVE-2025-69115?

Within 24 hours: Audit all WordPress installations for LuxMed theme usage (versions ≤1.2.2) and immediately disable or remove the affected theme if present. Within 7 days: Deploy a Web Application Firewall rule blocking LFI patterns and conduct forensic review of web server logs for exploitation attempts. Within 30 days: Migrate to an alternative theme or maintain only if vendor releases a confirmed patch with testing in a staging environment first.

LuxMed WordPress Theme CVE-2025-69115

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP WordPress Information Disclosure LFI Luxmed Medicine Healthcare Doctor Wordpress Theme

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint, no auth or user interaction, but AC:H reflects needing a specific parameter and a stageable local file; LFI to PHP include yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:47 vuln.today

CVE Published

Jun 17, 2026 - 12:47 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX LuxMed Medicine & Healthcare Doctor WordPress theme versions 1.2.2 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server. The flaw is CWE-98 (improper control of filename for include/require) and carries CVSS 8.1 (high), though attack complexity is high; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected product is a commercial WordPress theme distributed by ThemeREX (cpe:2.3:a:themerex:luxmed_|_medicine_&_healthcare_doctor_wordpress_theme) targeted at medical and clinic websites. CWE-98 describes PHP Remote File Inclusion / Local File Inclusion caused by improper sanitization of a filename or path parameter passed to PHP include/require statements, allowing an attacker-controlled value to dictate which file the PHP interpreter loads. In WordPress themes this class of bug typically appears in a theme template loader, AJAX endpoint, or shortcode handler that takes a parameter (e.g. file, template, view) from HTTP input and concatenates it into an include() call without enforcing an allowlist or path normalization.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/luxmed/vulnerability/wordpress-luxmed-medicine-healthcare-doctor-wordpress-theme-theme-1-2-2-local-file-inclusion-vulnerability) is the authoritative reference and should be consulted for any fixed build above 1.2.2 once published. Until a patched version is available, operators should deactivate and remove the LuxMed theme and switch to a maintained alternative (the strongest mitigation but causes site appearance/functionality loss), or place a WAF rule in front of WordPress that blocks requests containing path-traversal sequences (../, ..%2f, php://, file://, data://) and suspicious file/template/view parameters targeting theme PHP files (low functional impact but bypassable if the vulnerable parameter name is unknown). Harden PHP by setting allow_url_include=Off (should already be the default) and open_basedir to the WordPress document root to limit which files the include can reach, accepting that this can break plugins that legitimately access files outside that path.