What is the CVSS score of CVE-2025-69116?

CVE-2025-69116 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Iona WordPress Theme are affected by CVE-2025-69116?

The Iona WordPress theme (versions 1.0.8 and earlier) contains a high-severity vulnerability allowing unauthenticated attackers to extract sensitive files and potentially execute code on affected…

How to fix or mitigate CVE-2025-69116?

Within 24 hours: Inventory all WordPress installations using Iona theme; immediately disable the theme and activate an alternative. Within 7 days: Review Patchstack and vendor advisories for patch releases; implement Web Application Firewall (WAF) rules blocking path traversal patterns if theme remains temporarily active. Within 30 days: Complete migration to a patched version of Iona (if released) or switch permanently to an alternative supported WordPress theme.

Iona WordPress Theme CVE-2025-69116

EUVD-2025-210196 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Iona

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated LFI with no UI; AC:H reflects path-knowledge or config dependency; full CIA impact since included files can yield code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:02 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Iona WordPress theme versions 1.0.8 and earlier allows remote attackers to coerce the PHP application into including arbitrary local files, enabling source code disclosure and potentially full remote code execution. Reported by Patchstack and tracked as EUVD-2025-210196, the flaw is rated CVSS 8.1 (High) despite high attack complexity, with no public exploit identified at time of analysis.

Technical ContextAI

Iona is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:iona). The weakness is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. This class of bug occurs when user-controlled input is passed to PHP's include(), require(), include_once(), or require_once() statements without proper sanitization or path validation, allowing an attacker to manipulate which file the PHP interpreter loads and executes. In WordPress themes this typically surfaces through AJAX endpoints, template loader parameters, or shortcode handlers that accept a filename or path component from the request.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version is not independently confirmed in the provided data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/iona/vulnerability/wordpress-iona-theme-1-0-8-local-file-inclusion-vulnerability) and the ThemeREX vendor portal for the latest Iona release above 1.0.8 and update immediately. Until a confirmed patched version is installed, compensating controls include deactivating the Iona theme and switching to a maintained theme (trade-off: visual/site-design regression), placing a WAF rule (e.g., Patchstack mU+ vPatch, Wordfence) in front of the site to block path-traversal sequences such as ../, null bytes, and php:// wrappers in query parameters (trade-off: may break legitimate requests that legitimately pass file paths), and hardening php.ini with open_basedir restrictions and allow_url_include=Off plus disabling the file:// and phar:// stream wrappers where unused (trade-off: may break plugins relying on those wrappers).