What is the CVSS score of CVE-2025-69123?

CVE-2025-69123 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Snow Club Theme are affected by CVE-2025-69123?

Organizations running the ThemeRex Snow Club WordPress theme (version 1.1 and earlier) face a critical security gap: an unauthenticated vulnerability allows remote attackers to access sensitive…

How to fix or mitigate CVE-2025-69123?

Within 24 hours: Inventory all WordPress installations using ThemeRex Snow Club theme version 1.1 or earlier; immediately disable or replace the affected theme with an alternative. Within 7 days: Deploy WAF rules to block local file inclusion attack patterns (directory traversal sequences); harden file permissions on sensitive configuration files (wp-config.php, .env); implement request filtering for suspicious include parameters. Within 30 days: Complete migration to alternative WordPress theme; monitor Patchstack advisories for vendor patch release; conduct forensic review of affected servers for unauthorized file access in logs.

Snow Club Theme CVE-2025-69123

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Snow Club

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme, no auth or interaction (PR:N/UI:N); AC:H reflects need to identify specific vulnerable parameter; LFI commonly yields full CIA impact via wp-config disclosure and log-poisoning to RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:46 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Snow Club WordPress theme versions 1.1 and earlier allows remote attackers to include and execute arbitrary local files on the host, leading to sensitive file disclosure and potential remote code execution. The flaw is reported by Patchstack and maps to CWE-98 (PHP file inclusion); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Snow Club is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:snow_club). The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning a PHP include()/require() call inside the theme consumes attacker-controllable input - typically a request parameter passed through a theme template loader, AJAX handler, or shortcode renderer - without restricting it to an allowlisted path. Because WordPress themes execute in the context of the web server's PHP process, an included file is parsed as PHP if it contains PHP tags, turning a path-traversal primitive into arbitrary local file read and, where uploaded or log-poisoned content is reachable, code execution.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory does not cite a fixed version, so administrators should monitor ThemeRex for an update beyond 1.1 and apply it as soon as available (advisory: https://patchstack.com/database/wordpress/theme/snow-club/vulnerability/wordpress-snow-club-theme-1-1-local-file-inclusion-vulnerability). In the interim, deploy a WAF rule (Patchstack, Wordfence, or ModSecurity) that blocks path-traversal sequences (../, encoded variants, php://, data://, file:// wrappers) on requests to the theme's PHP endpoints; the side effect is potential false positives on legitimate parameters containing dots. Operators can also switch to an alternative theme temporarily, harden PHP by setting open_basedir to the WordPress root and disabling allow_url_include, and restrict file permissions on wp-config.php and log files to reduce the blast radius of any successful include - accepting that these controls reduce but do not eliminate exposure.