What is the CVSS score of CVE-2025-69143?

CVE-2025-69143 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Mission WordPress Theme are affected by CVE-2025-69143?

ThemeREX Mission WordPress theme (versions ≤1.22) is vulnerable to unauthenticated file access attacks; no public exploit has been identified, but the lack of vendor patch and the theme's widespread…

How to fix or mitigate CVE-2025-69143?

Within 24 hours: Identify all WordPress instances using ThemeREX Mission theme ≤1.22 and document affected systems. Within 7 days: Deactivate and remove the theme from all deployments; if immediate removal is infeasible due to business constraints, implement WAF rules to block requests to theme directories. Within 30 days: Transition to an alternative theme; audit web server and application logs for exploitation indicators.

Mission WordPress Theme CVE-2025-69143

EUVD-2025-210209 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Mission

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable LFI (AV:N, PR:N, UI:N); AC:H reflects filter/wrapper bypass implied by the vendor rating; full triad impact since LFI commonly enables config disclosure and RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:55 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Mission <= 1.22 versions.

AnalysisAI

Unauthenticated Local File Inclusion affects the ThemeREX Mission WordPress theme in all versions up to and including 1.22, enabling remote attackers to coerce the PHP application into including arbitrary local files. Exploitation can lead to sensitive file disclosure, source-code exposure, and - depending on what files are accessible on the server - remote code execution via log poisoning or PHP wrapper abuse. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP), the canonical root cause for PHP file inclusion bugs. The affected component (CPE cpe:2.3:a:themerex:mission) is a commercial WordPress theme distributed by ThemeREX, meaning the vulnerable code lives in a theme template or AJAX handler that passes attacker-controlled input into a PHP include/require call without proper sanitization or path constraints. Because WordPress themes load within the main PHP request lifecycle, an LFI in a theme inherits the privileges of the web server process and the full WordPress configuration context (wp-config.php, database credentials, secret keys).

RemediationAI

No vendor-released patched version is identified in the available data - the Patchstack record covers versions through 1.22 without naming a fixed release, so site operators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/mission/vulnerability/wordpress-mission-theme-1-22-local-file-inclusion-vulnerability) and ThemeREX's vendor channel for an updated build above 1.22 and upgrade as soon as one is published. As compensating controls until a patch is confirmed, deploy a WAF rule that blocks path-traversal sequences (../, ..%2f, php://, file://, data://) and null bytes against requests reaching theme PHP endpoints; restrict PHP's open_basedir and disable allow_url_include and allow_url_fopen in php.ini to neutralize remote wrapper abuse (side effect: may break plugins that fetch remote resources); and consider switching to an alternate theme if the vendor does not respond - note that theme replacement requires layout re-validation. Patchstack subscribers can apply the vPatch as an immediate virtual mitigation.