What is the CVSS score of CVE-2025-69119?

CVE-2025-69119 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Corbesier WordPress Theme are affected by CVE-2025-69119?

The Corbesier WordPress theme versions 1.15.0 and earlier contains an unauthenticated remote file inclusion vulnerability (CVE-2025-69119, CVSS 8.1) with no public exploit identified at time of…

How to fix or mitigate CVE-2025-69119?

24 hours: Audit all WordPress instances for Corbesier theme deployment; immediately deactivate or remove the theme from any affected systems. 7 days: Replace Corbesier with an alternative WordPress theme; deploy Web Application Firewall (WAF) rules to block directory traversal patterns (../, file://) and file inclusion attempts targeting the vulnerable theme paths. 30 days: Complete migration away from Corbesier theme across all WordPress environments; establish weekly automated vulnerability scanning for WordPress plugins and themes.

Corbesier WordPress Theme CVE-2025-69119

EUVD-2025-210198 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Corbesier

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H reflects needing to discover the vulnerable parameter; LFI primarily discloses files (C:H), with I/A only via secondary chains (I:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:01 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the Corbesier WordPress theme (versions ≤ 1.15.0) allows remote attackers to read arbitrary server files or potentially execute code by abusing improper validation of file paths passed to PHP include/require functions. The flaw is reachable without credentials and carries a CVSS 3.1 score of 8.1; no public exploit identified at time of analysis, and it is not listed in CISA KEV. The combination of network reachability and unauthenticated access makes any vulnerable WordPress site running this theme an immediate concern despite the high attack complexity rating.

Technical ContextAI

Corbesier is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:corbesier). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. In WordPress themes this class of bug typically arises when a theme file (often an AJAX handler, template loader, or shortcode renderer) accepts a user-controlled parameter and passes it into include, require, or include_once without enforcing an allowlist or stripping directory traversal sequences. Successful inclusion of local PHP files can disclose secrets such as wp-config.php contents or pivot to code execution when combined with file-upload primitives or log-poisoning techniques.

RemediationAI

No vendor-released patch identified at time of analysis - the EUVD entry lists fixed-version as 'n/a' and no patched release number appears in the Patchstack reference, so verify directly with ThemeREX whether a version above 1.15.0 resolves the issue and upgrade as soon as one is published (advisory: https://patchstack.com/database/wordpress/theme/corbesier/vulnerability/wordpress-corbesier-theme-1-15-0-local-file-inclusion-vulnerability). In the interim, Patchstack (or an equivalent WordPress vulnerability firewall such as Wordfence) can virtually patch the vulnerable parameter, which is the lowest-friction compensating control. Alternatively, identify the vulnerable PHP entry point (typically a theme AJAX action, template loader, or shortcode handler) via the Patchstack advisory and block requests carrying directory traversal sequences or .php path parameters at the WAF/reverse-proxy layer - be aware this can break legitimate theme features that legitimately load dynamic templates. Switching to a different theme until a fix ships eliminates the exposure entirely but requires re-theming effort.