What is the CVSS score of CVE-2025-69120?

CVE-2025-69120 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Dazzle WordPress Theme are affected by CVE-2025-69120?

The Dazzle WordPress theme by ThemeRex (versions ≤1.0.0) contains an unauthenticated local file inclusion vulnerability enabling attackers to read sensitive server files without logging in, risking…

How to fix or mitigate CVE-2025-69120?

Within 24 hours: Identify all servers running Dazzle theme versions ≤1.0.0 and immediately disable the theme by switching to an alternative WordPress theme. Within 7 days: If business requirements necessitate continued theme use, deploy Web Application Firewall rules to block file path traversal patterns (../, etc.) and configure web server open_basedir directives to restrict PHP file access. Within 30 days: Monitor ThemeRex security channels for patch availability; upon release, test the patched version in staging before production deployment.

Dazzle WordPress Theme CVE-2025-69120

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Dazzle

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable, no auth, but AC:H reflects the non-trivial parameter discovery; LFI primarily discloses files (C:H) with secondary I/A impact only if escalated to RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:46 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.

AnalysisAI

Unauthenticated Local File Inclusion affects the Dazzle WordPress theme (by ThemeRex) in versions up to and including 1.0.0, allowing remote attackers to read or potentially include arbitrary local files on the server. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98), and no public exploit has been identified at time of analysis. With a CVSS 8.1 reflecting high attack complexity but no authentication, the vulnerability is reachable by anonymous attackers but requires specific conditions to weaponize fully.

Technical ContextAI

Dazzle is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:dazzle). The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a PHP file in the theme passes attacker-controllable input into an include(), require(), include_once(), or require_once() call without sufficient validation against a safe allowlist. In WordPress themes, this pattern commonly appears in AJAX handlers, custom shortcodes, or dynamic template loaders that accept a file or template name via GET/POST. Successful exploitation lets the attacker traverse the filesystem to read sensitive files (e.g., wp-config.php containing database credentials and auth keys) or, depending on PHP configuration and reachable upload paths, escalate to code execution by including a file containing PHP under the attacker's control.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory at https://patchstack.com/database/wordpress/theme/dazzle/vulnerability/wordpress-dazzle-theme-1-0-0-local-file-inclusion-vulnerability does not cite a fixed version, so administrators should monitor ThemeRex for a Dazzle release above 1.0.0 and apply it as soon as it is available. Until a patched version ships, the strongest compensating control is to deactivate and switch away from the Dazzle theme on production sites, since LFI in an active theme is reachable on any front-end request; if removal is not possible, place the site behind a WAF (Patchstack, Wordfence, or equivalent) with rules blocking path-traversal sequences (../, %2e%2e, php://, file://) on theme endpoints, restrict PHP open_basedir to the WordPress document root to limit which files can be included, set allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent escalation to remote file inclusion, and rotate wp-config.php secrets (AUTH_KEY, database password) on the assumption that the file may already have been read. Each control trades availability of theme features (WAF false-positives, open_basedir breaking legitimate includes) for reduced exploitability.