LuxMed WordPress Theme CVE-2025-69115

Target must be a WordPress site running the ThemeREX 'LuxMed | Medicine & Healthcare Doctor' theme at version 1.2.2 or earlier with the theme active so its vulnerable PHP endpoint is reachable. No authentication or user interaction is required (PR:N/UI:N), but AC:H indicates the attacker must craft a specific request against the vulnerable file/template parameter and, to reach full code execution rather than mere file disclosure, needs a way to place attacker-controlled content on the local filesystem (e.g. media upload, log poisoning) or a PHP stream wrapper enabled in php.ini. Exploitation is limited by the niche deployment footprint of this commercial medical theme and by PHP hardening settings such as open_basedir and disabled allow_url_include.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H is internally inconsistent with a pure information-disclosure LFI: it reports high impact across confidentiality, integrity and availability, which implies the inclusion can reach attacker-controlled PHP (effectively RCE via log poisoning, uploaded files, or PHP wrappers) - that is the realistic worst case for a WordPress LFI and explains the 8.1 score despite AC:H. PR:N and UI:N make it remotely reachable with no authentication, but AC:H signals that some non-trivial precondition (specific request shape, knowledge of a writable path, or interaction with another component) is needed. There is no EPSS score, no SSVC decision, no CISA KEV listing, and no public POC referenced - only the Patchstack advisory - so real-world exploitation pressure is currently low, but the niche audience (medical/clinic sites running an unmaintained ThemeREX product) and the unauthenticated nature mean any published POC would rapidly shift this from theoretical to opportunistic mass-scan territory.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable theme endpoint, supplying a path parameter that traverses to a local file under attacker control - for example a previously uploaded media file, a poisoned web-server log, or a PHP filter wrapper - causing the WordPress PHP process to include and execute it. Successful exploitation yields code execution as the web-server user, enabling webshell deployment, database credential theft from wp-config.php, and patient data exfiltration from the medical site. No public POC is referenced in the supplied data, so an attacker would first need to reverse-engineer the vulnerable parameter from the theme source.