What is the CVSS score of CVE-2025-69124?

CVE-2025-69124 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Especio WordPress Theme are affected by CVE-2025-69124?

The ThemeRex Especio WordPress theme (versions 1.0 and earlier) contains a critical unauthenticated file inclusion vulnerability allowing remote attackers to access sensitive server files and…

How to fix or mitigate CVE-2025-69124?

Within 24 hours: Inventory all WordPress installations using ThemeRex Especio ≤1.0 and restrict network access to wp-admin if possible. Within 7 days: Deactivate and remove the vulnerable theme, replacing it with an alternative WordPress theme from a verified source. Within 30 days: Establish a formal theme management policy requiring security review of all WordPress plugins and themes before deployment, and subscribe to theme vendor security notifications.

Especio WordPress Theme CVE-2025-69124

EUVD-2025-210201 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Especio

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable theme endpoint, no auth or interaction; AC:H because the exact vulnerable parameter is undisclosed; LFI reliably yields C:H but I/A are only Low without confirmed RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:59 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Especio <= 1.0 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the ThemeRex Especio WordPress theme (versions ≤ 1.0) allows remote attackers to coerce the PHP application into including arbitrary files from the underlying server. Because the include path is attacker-controlled and no authentication is required, the flaw can lead to disclosure of sensitive files (wp-config.php, system files) and, depending on local file primitives available on the server, escalation to code execution. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Especio is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:especio). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP file inclusion. A PHP include/require statement within the theme consumes user-controllable input - typically via a GET/POST parameter or an AJAX handler - without restricting it to an allow-list, normalizing the path, or appending a fixed extension. This permits traversal sequences or absolute paths that resolve to local files outside the theme directory, and on PHP builds where include wrappers are reachable it can extend to log poisoning or session-file inclusion for code execution.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory (https://patchstack.com/database/wordpress/theme/especio/vulnerability/wordpress-especio-theme-1-0-local-file-inclusion-vulnerability) does not cite a fixed version above 1.0, so operators should check the ThemeRex customer portal for an updated build and, in its absence, deactivate and remove the Especio theme until a patched release is available (switching to a default theme such as Twenty Twenty-Four is the cleanest workaround but will change site appearance). Compensating controls include placing the site behind a WAF with rules that block path-traversal sequences (../, %2e%2e, php://, file://) and null-byte payloads on theme endpoints; restricting PHP's open_basedir to the WordPress install root so includes cannot reach /etc or /var; and setting allow_url_include=Off and disable_functions for risky wrappers. Each of these reduces but does not eliminate exposure and may break legitimate theme AJAX calls, so test in staging first.