Ingenioso WordPress Theme CVE-2025-69117

The target must be a WordPress site running the ThemeREX Ingenioso theme at version 1.14.0 or earlier, with the theme actively loaded so its vulnerable PHP entry point is reachable over HTTP(S). Per CVSS PR:N/UI:N, no authentication and no victim interaction are needed, but AC:H reflects that the attacker must identify the specific theme script and parameter that flow into the PHP include, and must point it at a file that exists on disk and is readable by the web-server user; meaningful escalation to RCE additionally requires a writable or attacker-influenced file (uploads directory, web-server log, session file) within reach of the include. Exploitation is constrained by PHP configuration - open_basedir, disabled allow_url_include, and chroot/containerisation all narrow what files can be included, and front-end WAFs such as Patchstack or Wordfence with current rules can block the traversal payload.

Signals are mixed. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 and explicitly marks the issue as unauthenticated and network-reachable, with high impact across CIA - consistent with LFI escalating to code execution. However, AC:H indicates the attacker must satisfy non-trivial preconditions (likely finding the correct vulnerable endpoint, valid parameter, and a includable target file), which tempers raw exploitability. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input, so widespread automated exploitation is not currently evidenced. The realistic priority for operators running Ingenioso is high because LFI in WordPress themes is a well-understood class with reusable tradecraft, but for the broader population this is a targeted-risk rather than mass-exploitation issue. Patchstack is the sole reporter; an independent NVD-confirmed fixed version is not present in the supplied data.

An attacker enumerates a WordPress site, identifies the Ingenioso theme via fingerprinting (theme paths, CSS handles), and crafts an HTTP GET request to a vulnerable theme endpoint with a path-traversal payload in the include parameter to read wp-config.php and harvest database credentials and AUTH_KEY secrets. With those credentials, or by chaining the LFI with log poisoning or an uploaded image containing PHP, the attacker pivots to remote code execution under the web-server user. No authentication or user interaction is required, but the attacker must first discover the correct vulnerable parameter, consistent with the CVSS AC:H rating.