What is the CVSS score of CVE-2025-69125?

CVE-2025-69125 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Food Drop are affected by CVE-2025-69125?

The Food Drop WordPress theme (versions 1.3 and earlier) contains a remote file inclusion vulnerability (CVE-2025-69125, CVSS 8.1) exploitable without authentication, allowing attackers to read…

How to fix or mitigate CVE-2025-69125?

Within 24 hours: Scan all WordPress deployments to identify Food Drop theme versions ≤1.3; prioritize affected sites by data sensitivity and public exposure. Within 7 days: Deactivate and remove Food Drop theme from all affected sites; migrate to an actively maintained, patched theme or implement compensating controls. Within 30 days: Monitor Patchstack advisory (EUVD-2025-210202) for patch release; immediately test and deploy patched version across infrastructure upon vendor release.

Food Drop CVE-2025-69125

EUVD-2025-210202 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Food Drop

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H for parameter/traversal discovery; full C:H from arbitrary file read, but I/A only Low absent confirmed RCE path.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:59 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Food Drop <= 1.3 versions.

AnalysisAI

Unauthenticated local file inclusion in the Food Drop WordPress theme versions 1.3 and earlier allows remote attackers to read arbitrary server files or potentially achieve PHP code execution by abusing an improperly controlled include/require path (CWE-98). The flaw was disclosed by Patchstack and tracked as EUVD-2025-210202; no public exploit code or active exploitation has been identified at time of analysis, but the network-reachable, no-auth attack surface makes it a meaningful risk for any site running this theme.

Technical ContextAI

The affected component is the Food Drop WordPress theme (CPE cpe:2.3:a:themerex:food_drop) published by ThemeRex, a PHP-based theme typically deployed on the front-end of WordPress sites. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion') indicates the theme passes user-controlled input into a PHP include(), require(), include_once() or require_once() call without proper sanitization or allow-listing. In WordPress themes this typically appears as a parameter that selects a template, view, or partial file; if the value is not constrained to a known set, an attacker can traverse the filesystem (../) or, with allow_url_include enabled, reference external resources, leading to disclosure of files such as wp-config.php or execution of attacker-controlled PHP.

RemediationAI

Upstream fix available per the Patchstack advisory; a released patched version is not independently confirmed from the provided data, so administrators should upgrade Food Drop to the latest vendor release above 1.3 once published and verify the version on disk after upgrade - consult https://patchstack.com/database/wordpress/theme/food-drop/vulnerability/wordpress-food-drop-theme-1-3-local-file-inclusion-vulnerability for the authoritative fix reference. Until a fixed build is applied, compensating controls include deactivating and removing the Food Drop theme and switching to an unaffected theme (side effect: site appearance changes), placing a WAF rule in front of WordPress that blocks path-traversal sequences (../, encoded variants, php://, file://) and known-bad parameter values on theme endpoints (side effect: may break legitimate template selection in edge cases), setting PHP's allow_url_include=Off and tightening open_basedir to the WordPress document root (side effect: may impact plugins that rely on remote includes), and restricting filesystem read permissions on sensitive files like wp-config.php to the web user only.