What is the CVSS score of CVE-2025-69142?

CVE-2025-69142 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Abelle WordPress Theme are affected by CVE-2025-69142?

The Abelle WordPress theme (versions 1.22 and earlier) contains an unauthenticated file inclusion vulnerability (CVE-2025-69142, CVSS 8.1) enabling remote attackers to read sensitive server files and…

How to fix or mitigate CVE-2025-69142?

Within 24 hours: Audit all WordPress installations for Abelle theme usage and affected versions. Within 7 days: Implement interim controls (WAF rules blocking path traversal patterns, restrict permissions on /wp-content/themes/abelle/, disable file upload features if operationally feasible). Within 30 days: Replace or upgrade the theme when vendor releases a patched version; validate any patches in staging before production deployment.

Abelle WordPress Theme CVE-2025-69142

EUVD-2025-210208 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Abelle

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Unauthenticated network-reachable LFI (AV:N/PR:N/UI:N) with AC:H per advisory; high read impact, but integrity/availability only realised via secondary log-poisoning so rated Low.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:56 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.

AnalysisAI

Unauthenticated local file inclusion in the Abelle WordPress theme versions 1.22 and earlier allows remote attackers to coerce the PHP runtime into including attacker-controlled file paths, leading to disclosure of sensitive server files and potential remote code execution if log poisoning or uploaded files can be reached. The flaw is reachable without credentials, but CVSS notes high attack complexity, and no public exploit identified at time of analysis. No EPSS or KEV signal is provided in the source data.

Technical ContextAI

Abelle is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:abelle), and like many premium themes it exposes PHP entry points that load template or include paths derived from request parameters. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, a.k.a. PHP Remote File Inclusion) covers cases where untrusted input flows into include/require/include_once/require_once without canonicalisation or allowlisting, letting an attacker traverse the filesystem (../) or, when allow_url_include is enabled, fetch a remote PHP payload. In a WordPress context the vulnerable include typically lives in a theme PHP file invoked via wp-admin/admin-ajax.php, admin-post.php, or a public theme endpoint that does not gate the action behind a capability check, which is why exploitation is unauthenticated.

RemediationAI

No vendor-released patch identified at time of analysis - the supplied data lists no fixed Abelle version and no ThemeREX changelog reference, only the Patchstack advisory (https://patchstack.com/database/wordpress/theme/abelle/vulnerability/wordpress-abelle-theme-1-22-local-file-inclusion-vulnerability), so administrators should monitor that page and the ThemeREX dashboard for a release above 1.22 and update as soon as one ships. Until a fix is available, deactivate and remove the Abelle theme if it is not the active site theme, or place the site behind a WAF rule (Patchstack/Wordfence virtual patches typically ship for advisories they author) that blocks path-traversal sequences (../, %2e%2e, php://, data://, expect://) on requests reaching theme PHP files and admin-ajax.php/admin-post.php actions registered by the theme. Defence-in-depth on the PHP runtime - setting allow_url_include=Off, restricting open_basedir to the WordPress root, and disabling unused stream wrappers - narrows LFI to RCE pivots at the cost of breaking any plugin that legitimately uses remote includes or stream wrappers; on the WordPress side, hardening wp-config.php permissions to 400 and disabling DISALLOW_FILE_EDIT/MODS limits the value of a successful read.