What is the CVSS score of CVE-2025-69136?

CVE-2025-69136 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Wanium WordPress Theme are affected by CVE-2025-69136?

The Wanium WordPress theme (versions ≤1.9.8) contains a Local File Inclusion vulnerability permitting unauthenticated remote attackers to access sensitive files and potentially execute arbitrary code…

How to fix or mitigate CVE-2025-69136?

24 hours: Audit all WordPress installations to identify those running Wanium theme version 1.9.8 or earlier; immediately disable the theme on affected sites pending remediation. 7 days: Remove the Wanium theme entirely and deploy a maintained alternative, or if business-critical, implement Web Application Firewall rules blocking Local File Inclusion and directory traversal patterns, plus restrict PHP execution in theme directories. 30 days: Monitor WordPress theme repository and Patchstack for vendor patch release (target version 1.9.9+); re-enable only after patch release and full non-production validation.

Wanium WordPress Theme CVE-2025-69136

EUVD-2025-210204 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Wanium

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable theme endpoint, unauthenticated (PR:N) with no user interaction; AC:H reflects the specific parameter conditions; LFI to RCE yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:58 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Wanium <= 1.9.8 versions.

AnalysisAI

Local File Inclusion in the Wanium WordPress theme (versions up to and including 1.9.8) allows remote unauthenticated attackers to coerce the application into including arbitrary local PHP files, leading to source disclosure and potential remote code execution on the server. The flaw was disclosed via Patchstack and tracked as EUVD-2025-210204; no public exploit identified at time of analysis, and the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable exploitation that nevertheless requires some non-trivial conditions to succeed.

Technical ContextAI

Wanium is a commercial WordPress theme published by ThemeLogi (CPE cpe:2.3:a:themelogi:wanium). The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. This class of bug occurs when user-supplied input is concatenated into a PHP include(), require(), include_once(), or require_once() call without proper sanitization or whitelist enforcement, allowing an attacker to control which file the PHP interpreter loads and executes. In WordPress themes this typically manifests through a template-routing parameter (for example a 'page', 'view', or 'file' query argument handled inside the theme's PHP files) that is passed directly to an include construct.

RemediationAI

No vendor-released patch identified at time of analysis based on the supplied references; administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/wanium/vulnerability/wordpress-wanium-theme-1-9-8-local-file-inclusion-vulnerability) and the ThemeLogi vendor portal for a Wanium release above 1.9.8 and upgrade as soon as it is available. Until a fix ships, consider deploying a virtual patch via Patchstack's WordPress firewall or an equivalent WAF rule that blocks requests containing path-traversal sequences (../, encoded variants, php:// and file:// wrappers) targeting the theme's PHP entry points, with the trade-off that legitimate requests using similar parameters may be blocked; switching the site to a different theme temporarily eliminates the exposed code path but breaks site presentation, and disabling PHP wrappers (allow_url_include=Off, restricting open_basedir to the WordPress root) reduces blast radius from full RCE to information disclosure but does not close the underlying flaw.