Deliciosa WordPress Theme CVE-2025-69121

The target site must have the ThemeRex Deliciosa theme installed and active at version 1.10.0 or earlier, and the vulnerable LFI-handling endpoint (not specified in the public advisory excerpt) must be reachable over the network from the attacker. Exploitation is unauthenticated and requires no user interaction (PR:N/UI:N), but the CVSS AC:H rating signals additional non-trivial conditions - likely specific request crafting, parameter encoding, or a filter/normalization bypass - that a naive payload will not satisfy. Practical impact escalation beyond file read (e.g., RCE) further depends on PHP configuration (allow_url_include, available wrappers) and the presence of attacker-writable files such as logs or uploads on the same host.

The CVSS 3.1 base score of 8.1 reflects PR:N/UI:N (no auth, no user interaction) with C:H/I:H/A:H impact, tempered by AC:H - suggesting non-trivial preconditions such as specific request structure, race window, or filtering bypass. KEV listing is absent and no EPSS score was provided in the input, and no POC has been published, so this currently reads as a high-severity disclosure without confirmed mass exploitation. The realistic priority depends on how widely Deliciosa is deployed and whether the AC:H gate is a hard filter or merely a crafted-payload requirement; LFI bugs in PHP themes have historically chained to RCE via log/session poisoning or PHP filter chains, so defenders should not discount it because of AC:H alone. Key data gap: Patchstack’s advisory page is behind their database and details on the exact vulnerable endpoint and any privately observed exploitation were not in the provided references.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Deliciosa theme endpoint that passes a parameter into a PHP include/require, traversing the filesystem to read wp-config.php and exfiltrate database credentials and AUTH/SECRET keys. With those secrets, the attacker pivots to the database or forges WordPress auth cookies; if PHP filter chains or log/upload poisoning are reachable, the LFI escalates to remote code execution as the web server user. The AC:H rating implies the request requires specific crafting, but no public exploit identified at time of analysis.