What is the CVSS score of CVE-2025-69126?

CVE-2025-69126 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Fortius Theme are affected by CVE-2025-69126?

ThemeRex Fortius WordPress theme versions 2.3.0 and earlier contain an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that allows attackers to access arbitrary server files without…

How to fix or mitigate CVE-2025-69126?

Within 24 hours: inventory all WordPress installations and identify Fortius theme deployments; enable Web Application Firewall rules blocking path traversal patterns in HTTP requests. Within 7 days: either remove the Fortius theme and deploy an alternative, or implement strict input validation controls on vulnerable parameters; monitor for exploitation attempts. Within 30 days: complete migration away from Fortius to a vendor-supported, patched theme for all remaining installations.

Fortius Theme CVE-2025-69126

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Fortius

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N) with AC:H reflecting specific payload/conditions; C:H for file disclosure, I/A:L since code execution requires additional preconditions.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:45 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Fortius WordPress theme (versions 2.3.0 and earlier) allows remote attackers to include and disclose arbitrary local files on the server via a vulnerable PHP file/path parameter. The flaw maps to CWE-98 (improper control of filename for include/require) and can lead to source code disclosure, leakage of WordPress secrets in wp-config.php, and in some PHP setups remote code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Fortius is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:fortius:*). The vulnerability falls under CWE-98, improper control of filename for PHP include/require statements, where user-controlled input flows into a dynamic include without proper allowlisting or path canonicalization. In WordPress theme contexts this commonly appears in AJAX handlers, shortcode renderers, or template-loader endpoints accessible through admin-ajax.php or direct theme PHP files, allowing traversal sequences or unrestricted path values to load arbitrary files from the filesystem. Depending on PHP configuration (allow_url_include, log poisoning, session/upload paths), an LFI of this class can escalate from read-only file disclosure to arbitrary PHP code execution.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data; site operators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/fortius/vulnerability/wordpress-fortius-theme-2-3-0-local-file-inclusion-vulnerability for any fix version published after 2.3.0 and upgrade to it as soon as released. Until a fixed Fortius version is confirmed, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block path-traversal sequences (../, encoded variants, null bytes) and absolute filesystem paths in requests to the theme's PHP endpoints, and consider temporarily switching to a different theme on high-value sites as the most reliable mitigation. Harden PHP by setting open_basedir to the WordPress document root and disabling allow_url_include, and restrict read access to wp-config.php and other sensitive files at the web-server layer - note that WAF rules can be bypassed by novel encodings and open_basedir may break legitimate theme functionality that loads files outside the docroot.