Fortius Theme CVE-2025-69126

Target site must have the ThemeRex Fortius theme installed and active at version 2.3.0 or earlier, with the vulnerable theme PHP endpoint reachable over HTTP(S) from the attacker. No authentication is required (PR:N), but the high attack complexity (AC:H) indicates exploitation depends on specific, non-trivial conditions - likely knowledge of the exact vulnerable parameter name and a payload that survives whatever partial sanitization exists, and for code-execution outcomes additional preconditions such as readable PHP-accessible log/session files or a permissive allow_url_include setting. Exploitation is limited to sites running this specific commercial theme, which constrains the target population versus a core WordPress flaw.

Patchstack assigns CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting an unauthenticated network-reachable flaw with high impact across confidentiality, integrity, and availability but elevated attack complexity - likely because the vulnerable parameter or endpoint requires non-trivial knowledge or specific conditions to trigger. There is no EPSS score, no SSVC decision data, and no KEV listing supplied, and no public PoC has been identified, so real-world exploitation pressure is currently unproven. However, the I:H/A:H rating implies the researcher believes the LFI can be chained to write/execute outcomes (e.g., via log or session file inclusion), which on a WordPress site typically means full site compromise; combined with the niche commercial-theme install base, this is a credible targeted-attack risk rather than a mass-exploitation candidate. The single Patchstack reference is the only intelligence source available, so version coverage above 2.3.0 and patch state are not independently corroborated.

An external attacker fingerprints the Fortius theme on a target WordPress site (via theme path, CSS, or generator meta) and sends a crafted unauthenticated HTTP request to the vulnerable theme PHP endpoint with a traversal payload such as ../../../../wp-config.php to retrieve database credentials and WordPress secret keys. With those secrets the attacker pivots to authenticated takeover or, by including a poisoned access log or uploaded file, achieves PHP code execution as the web-server user. No public exploit is identified at time of analysis, so weaponization would require independent vulnerability research.