Iona WordPress Theme CVE-2025-69116

Exploitation requires the WordPress site to have the Iona theme by ThemeREX installed and active at version 1.0.8 or earlier, and the attacker must be able to reach the vulnerable theme endpoint over HTTP/HTTPS (no authentication or user interaction needed per CVSS PR:N/UI:N). The CVSS AC:H rating indicates additional non-default conditions limit reliable exploitation - likely knowledge of the absolute server path to a target file, a specific PHP/WordPress configuration that permits the inclusion sink to resolve attacker input, or stream-wrapper availability (e.g., phar://, php://filter) - and the specific vulnerable parameter is not enumerated in the public CVE description, so defenders should treat the Patchstack advisory as the authoritative source for the exact sink.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates a network-reachable, unauthenticated bug with no user interaction but HIGH attack complexity - meaning successful exploitation depends on conditions outside the attacker's direct control (e.g., specific server configuration, knowledge of internal paths, or race-like preconditions). The full C:H/I:H/A:H triad reflects the worst-case LFI outcome where included files can lead to code execution or sensitive data exposure. The vulnerability is not listed in CISA KEV, EPSS data was not provided, and no public proof-of-concept has been identified at the time of analysis, suggesting opportunistic mass exploitation is less likely than targeted abuse against known Iona deployments. Defenders should treat the AC:H rating with caution - Patchstack typically validates exploitability before publication, so the high complexity does not mean the issue is theoretical.

An unauthenticated remote attacker enumerates WordPress sites running the Iona theme via fingerprinting, then sends a crafted HTTP request to a vulnerable theme endpoint with a manipulated file-path parameter (e.g., traversal sequences or a PHP stream wrapper) that gets passed into a PHP include() call. The server returns or executes the attacker-chosen file, allowing read of wp-config.php to steal database credentials and secret keys, or - if combined with a writable log/session file or phar:// gadget - full PHP code execution as the web server user. No public POC was identified at time of analysis, but Patchstack-tracked LFIs in WordPress themes are frequently reproduced shortly after disclosure.