What is the CVSS score of CVE-2025-69141?

CVE-2025-69141 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Kelly Young theme are affected by CVE-2025-69141?

The Kelly Young WordPress theme (versions 1.1.0 and earlier) contains an unauthenticated network-accessible vulnerability enabling unauthorized file access and potential code execution.

How to fix or mitigate CVE-2025-69141?

Within 24 hours: Identify all WordPress instances running Kelly Young theme version 1.1.0 and earlier and deactivate immediately; notify affected business units and stakeholders of active risk. Within 7 days: Remove vulnerable theme entirely and deploy alternative WordPress theme; review web server and WordPress access logs for indicators of exploitation. Within 30 days: Deploy Web Application Firewall (WAF) rules to block local file inclusion patterns and path traversal attempts; implement WordPress security plugin with file inclusion detection; establish automated vulnerability scanning for all installed themes.

Kelly Young theme CVE-2025-69141

EUVD-2025-210207 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Kelly Young

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects required knowledge of vulnerable parameter and PHP-config-dependent technique; primary impact is file disclosure (C:H), with I/A only via secondary RFI/RCE chains hence Low.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:57 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Kelly Young <= 1.1.0 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Kelly Young WordPress theme (versions ≤1.1.0) allows remote attackers to read arbitrary local files and potentially achieve code execution by including attacker-controlled file paths via a vulnerable PHP include sink. The flaw is reachable without authentication over the network, and no public exploit identified at time of analysis. Risk is elevated by the high CVSS impact triad (C:H/I:H/A:H), though AC:H indicates non-trivial exploitation prerequisites.

Technical ContextAI

Kelly Young is a commercial WordPress theme published by ThemeRex (CPE cpe:2.3:a:themerex:kelly_young). The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a PHP include/require statement consumes attacker-influenced input without sufficient sanitization or allowlisting. In a WordPress theme context, this typically manifests as an AJAX endpoint, shortcode handler, or template loader that passes a request parameter into include/require, enabling traversal to local PHP/config files and, depending on PHP configuration (allow_url_include, wrappers like php://filter, log poisoning, or session/upload-file inclusion), full remote code execution within the web user's context.

RemediationAI

No vendor-released patched version is identified in the available data for the Kelly Young theme; until ThemeRex publishes a fix newer than 1.1.0, treat the theme as vulnerable and consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/kelly-young/vulnerability/wordpress-kelly-young-theme-1-1-0-local-file-inclusion-vulnerability) for the latest status and any virtual-patching guidance. Compensating controls: enable Patchstack or a WAF (Wordfence, NinjaFirewall) with rules that block path traversal sequences (../, %2e%2e, php://, file://) and null bytes on theme endpoints - trade-off is potential false positives on legitimate file-path parameters; deactivate and replace the Kelly Young theme with a maintained alternative if business needs allow (trade-off: visual/functional regressions requiring re-theming); harden php.ini by setting allow_url_include=Off and open_basedir to the WordPress webroot to contain disclosure to files under that path and prevent remote inclusion (trade-off: may break plugins relying on stream wrappers); and restrict outbound egress from the webserver to limit RFI/exfiltration pivots.