What is the CVSS score of CVE-2025-69117?

CVE-2025-69117 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Ingenioso WordPress Theme are affected by CVE-2025-69117?

ThemeREX Ingenioso WordPress theme versions 1.14.0 and earlier contain a local file inclusion vulnerability (CVSS 8.1) that allows unauthenticated attackers to access sensitive files or execute code…

How to fix or mitigate CVE-2025-69117?

Within 24 hours: Audit all WordPress installations to identify those using ThemeREX Ingenioso theme and document current installed versions; prepare incident response procedures and alert relevant stakeholders. Within 7 days: Implement Web Application Firewall (WAF) rules to detect and block file inclusion attack patterns; restrict PHP execution in wp-content/uploads and application log directories via .htaccess or server configuration; enforce strict file permissions on web-accessible directories; evaluate disabling the theme if business requirements allow. Within 30 days: Monitor official Patchstack and Ingenioso project channels for security updates; review web server and application logs for exploitation indicators; evaluate alternative WordPress themes as a longer-term remediation strategy.

Ingenioso WordPress Theme CVE-2025-69117

EUVD-2025-210227 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Ingenioso

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated HTTP-reachable LFI (AV:N, PR:N, UI:N); AC:H because attacker must locate the specific vulnerable parameter and a usable target file; full CIA impact via config disclosure and RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:43 vuln.today

CVE Published

Jun 17, 2026 - 09:50 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Ingenioso WordPress theme through version 1.14.0 allows remote attackers to coerce the PHP application into including arbitrary server-side files, leading to disclosure of sensitive content and potential remote code execution where uploaded or log-poisoned files can be reached. The flaw is classified under CWE-98 (improper control of filename for include/require) and was disclosed via Patchstack with no public exploit identified at time of analysis. CVSS is rated 8.1 (High) with high attack complexity, reflecting that successful exploitation depends on identifying a reachable include path.

Technical ContextAI

Ingenioso is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:ingenioso). Like many premium themes, it ships PHP templates and helper scripts that dynamically include files based on request parameters. CWE-98 covers cases where user-controllable input flows into PHP include/require/require_once without proper canonicalisation or allow-listing, letting an attacker traverse the filesystem or load attacker-controlled content. In a WordPress context this typically means a theme file accepts a name/page/template parameter and concatenates it into an include path, which can then resolve to wp-config.php, /etc/passwd, session files, log files, or uploaded media that contain PHP.

RemediationAI

Upgrade the Ingenioso theme to a version newer than 1.14.0 as published by ThemeREX once available; the supplied data lists the vulnerable range as <= 1.14.0 but does not name a specific fixed release, so administrators should consult the Patchstack entry (https://patchstack.com/database/wordpress/theme/ingenioso/vulnerability/wordpress-ingenioso-theme-1-14-0-local-file-inclusion-vulnerability) and the ThemeREX update channel for the patched version. Until patched, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) that blocks requests to Ingenioso theme PHP files containing path-traversal patterns (../, %2e%2e, php://, data://, null bytes) or absolute paths in query parameters - accepting the trade-off that overly broad rules may block legitimate template parameters. As a stronger temporary control, switch the site to a different theme or restrict access to /wp-content/themes/ingenioso/ at the web-server level for unauthenticated visitors, recognising this will break front-end rendering for that theme. Harden PHP by setting open_basedir to the WordPress install root and disabling allow_url_include, which limits the blast radius of any successful LFI but does not prevent local-file disclosure.