What is the CVSS score of CVE-2025-69118?

CVE-2025-69118 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of CopyPress WordPress Theme are affected by CVE-2025-69118?

The CopyPress WordPress theme (ThemeREX) through version 1.4.5 contains an unauthenticated file inclusion vulnerability that allows attackers to access sensitive server files, including database…

How to fix or mitigate CVE-2025-69118?

Within 24 hours: Inventory all WordPress installations to identify CopyPress theme deployments and determine versions in use. Within 7 days: Disable or remove CopyPress theme as interim measure; deploy WAF rules to block path traversal patterns (../ sequences); review and increase monitoring of PHP include/require logs for suspicious activity. Within 30 days: Migrate to alternative WordPress theme or wait for vendor patch; weekly monitor Patchstack and ThemeREX advisories for release of fix version.

CopyPress WordPress Theme CVE-2025-69118

EUVD-2025-210197 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Copypress

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress endpoint, no auth or user interaction, but AC:H reflects path/wrapper precondition; LFI of wp-config.php leads to full C/I/A impact via credential takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:01 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.

AnalysisAI

Unauthenticated local file inclusion in the CopyPress WordPress theme (ThemeREX) through version 1.4.5 lets remote attackers coerce the PHP include/require chain into loading arbitrary server-side files without credentials. Patchstack catalogued the flaw as CWE-98 with CVSS 8.1, and no public exploit identified at time of analysis. Successful exploitation can expose sensitive files such as wp-config.php and, depending on the include sink, escalate to PHP code execution.

Technical ContextAI

CopyPress is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:copypress). The vulnerability class is CWE-98 - Improper Control of Filename for Include/Require Statement in a PHP program, meaning user-controlled input flows into a PHP include(), require(), include_once(), or require_once() call without adequate sanitization or allowlisting. In WordPress themes this is typically realised via an AJAX/admin-ajax endpoint, REST route, or a template-loading shortcode that resolves a path parameter against the local filesystem, enabling directory traversal or wrapper-based inclusion (php://filter, data://, etc., depending on PHP configuration).

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack record fixes the vulnerable range at ≤1.4.5 without naming a patched build, so administrators should check the ThemeREX customer portal for a release newer than 1.4.5 and apply it as soon as available (advisory: https://patchstack.com/database/wordpress/theme/copypress/vulnerability/wordpress-copypress-theme-1-4-5-local-file-inclusion-vulnerability). Until a fixed release is confirmed, deploy a virtual patch via a WordPress WAF (Patchstack, Wordfence) which typically ships a vPatch rule the same day as disclosure; alternatively, block requests to the theme's PHP entry points containing path-traversal sequences (../, %2e%2e, php://, data://, file://) at the edge, accepting that this may break legitimate template parameters. As a last resort deactivate the CopyPress theme and switch to a default theme, which eliminates the site's branded appearance but is the only fully reliable mitigation absent a vendor fix.