Dazzle WordPress Theme
CVE-2025-69120
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Dazzle theme via fingerprinting
-
DeliveryCraft path-traversal request to vulnerable parameter
-
ExploitTrigger PHP include of wp-config.php
-
ExecutionExtract database credentials and keys
-
PersistAuthenticate or include attacker-controlled PHP
-
ImpactExecute code as web server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target WordPress site has the ThemeRex Dazzle theme installed and active at version 1.0.0 or earlier, and that the attacker can reach the vulnerable theme endpoint (a public-facing HTTP/HTTPS request - no WordPress account is needed per PR:N). The CVSS AC:H signals a non-trivial precondition, most likely knowledge of the specific vulnerable parameter and request shape (not disclosed in the public advisory) and possibly bypassing partial input sanitization with encoding or traversal tricks. Exploitation is limited by: PHP configuration (open_basedir, allow_url_include, disable_functions affect how far LFI escalates), the presence of a WAF that filters traversal patterns, and the fact that the theme must be the active theme - inactive installed themes are typically not reachable via front-end routes. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) describes an unauthenticated, network-reachable issue with high attack complexity and high impact across confidentiality, integrity, and availability - consistent with an LFI that, under the right conditions, escalates to RCE. The AC:H is notable: Patchstack/NVD evidently judged that some non-trivial condition (path manipulation, encoding, or a specific request shape) is required, which tempers the raw 8.1 score. No KEV listing and no public POC are referenced, so this is not confirmed actively exploited; EPSS data was not provided in the input. The C:H/I:H/A:H trio combined with PR:N still makes this a high-priority patch for any WordPress site running the Dazzle theme, because mass-scanning of WordPress themes for LFI is routine even without a published POC. Absence of EPSS and POC data is a real gap - treat exposure of Dazzle installs as the dominant risk factor. |
| Exploit ScenarioDerived | An attacker scans WordPress sites for the Dazzle theme fingerprint and sends a crafted HTTP request to a vulnerable theme endpoint with a path-traversal payload in the file parameter, causing PHP to include /var/www/html/wp-config.php and disclose database credentials and secret keys in the response. With those credentials, the attacker connects to the database or forges authenticated WordPress sessions, and where allow_url_include or a writable upload path is reachable, escalates to RCE by including a PHP payload. No public POC is identified, so an attacker would need to reverse the vulnerable parameter from the theme source. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated Local File Inclusion affects the Dazzle WordPress theme (by ThemeRex) in versions up to and including 1.0.0, allowing remote attackers to read or potentially include arbitrary local files on the server. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98), and no public exploit has been identified at time of analysis. With a CVSS 8.1 reflecting high attack complexity but no authentication, the vulnerability is reachable by anonymous attackers but requires specific conditions to weaponize fully.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack advisory at https://patchstack.com/database/wordpress/theme/dazzle/vulnerability/wordpress-dazzle-theme-1-0-0-local-file-inclusion-vulnerability does not cite a fixed version, so administrators should monitor ThemeRex for a Dazzle release above 1.0.0 and apply it as soon as it is available. Until a patched version ships, the strongest compensating control is to deactivate and switch away from the Dazzle theme on production sites, since LFI in an active theme is reachable on any front-end request; if removal is not possible, place the site behind a WAF (Patchstack, Wordfence, or equivalent) with rules blocking path-traversal sequences (../, %2e%2e, php://, file://) on theme endpoints, restrict PHP open_basedir to the WordPress document root to limit which files can be included, set allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent escalation to remote file inclusion, and rotate wp-config.php secrets (AUTH_KEY, database password) on the assumption that the file may already have been read. Each control trades availability of theme features (WAF false-positives, open_basedir breaking legitimate includes) for reduced exploitability.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dazzle is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:dazzle). The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a PHP file in the theme passes attacker-controllable input into an include(), require(), include_once(), or require_once() call without sufficient validation against a safe allowlist. In WordPress themes, this pattern commonly appears in AJAX handlers, custom shortcodes, or dynamic template loaders that accept a file or template name via GET/POST. Successful exploitation lets the attacker traverse the filesystem to read sensitive files (e.g., wp-config.php containing database credentials and auth keys) or, depending on PHP configuration and reachable upload paths, escalate to code execution by including a file containing PHP under the attacker's control.
Know when Dazzle gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable, no auth, but AC:H reflects the non-trivial parameter discovery; LFI primarily discloses files (C:H) with secondary I/A impact only if escalated to RCE.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
Executive ViewAI
The Dazzle WordPress theme by ThemeRex (versions ≤1.0.0) contains an unauthenticated local file inclusion vulnerability enabling attackers to read sensitive server files without logging in, risking exposure of database credentials, configuration secrets, and protected data. Although no public exploit has been identified at time of analysis, the CVSS score of 8.1 reflects serious risk to all organizations using this theme. Immediate remediation is required as no vendor-released patch has been identified at time of analysis.
Since no vendor-released patch has been identified at time of analysis, implement these interim mitigations: (1) Deploy Web Application Firewall rules blocking file path traversal and include/require patterns; (2) Configure web server open_basedir to restrict PHP file access scope; (3) Apply restrictive file system permissions for sensitive configuration files outside the web root; (4) Restrict WordPress administrator access to VPN or known IP ranges; (5) Enable comprehensive access logging and monitor for suspicious file inclusion attempts; (6) Establish regular monitoring of vendor security channels for potential patches.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB