What is the CVSS score of CVE-2025-69144?

CVE-2025-69144 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Preservation WordPress Theme are affected by CVE-2025-69144?

The ThemeREX Preservation WordPress theme (version 1.10 and earlier) contains an unauthenticated file inclusion vulnerability that allows remote attackers to read sensitive files including database…

How to fix or mitigate CVE-2025-69144?

Within 24 hours: Disable and remove ThemeREX Preservation theme from all WordPress installations; audit access logs for exploitation attempts against file paths like wp-config.php. Within 7 days: Migrate to an alternative WordPress theme and implement Web Application Firewall (WAF) rules to block local file inclusion patterns (../, php:// wrappers). Within 30 days: Establish monitoring for vendor advisories; if no patch released by day 30, implement permanent code-level mitigations or restrict theme use entirely.

Preservation WordPress Theme CVE-2025-69144

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Preservation

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable theme endpoint with no auth (AV:N/PR:N/UI:N); AC:H reflects non-obvious payload tuning; LFI gives C:H file read but only conditional I/A impact, so I:L/A:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:43 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Preservation WordPress theme versions 1.10 and earlier allows remote attackers to read arbitrary files from the underlying web server, with high complexity (AC:H) but no authentication required (PR:N). The flaw, reported by Patchstack and classified as CWE-98 (improper filename control for PHP include/require statements), can lead to disclosure of sensitive files such as wp-config.php and, depending on the inclusion path, potentially full code execution. No public exploit identified at time of analysis and no KEV listing.

Technical ContextAI

Preservation is a commercial WordPress theme distributed by ThemeREX (CPE themerex:preservation) and built on PHP. CWE-98 describes a class of bug where a PHP include(), require(), or related construct uses an attacker-influenced filename without sufficient validation, allowing the attacker to pivot the included path to an arbitrary local (or, when allow_url_include is on, remote) resource. In the WordPress theme context the typical sink is a parameter passed to a theme template loader, AJAX endpoint, or shortcode handler that concatenates user input into an include path, letting traversal sequences or direct paths reach files outside the intended template directory.

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version was not independently confirmed in the provided data, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/theme/preservation/vulnerability/wordpress-preservation-theme-1-10-local-file-inclusion-vulnerability and ThemeREX for the fixed release and upgrade beyond 1.10 as soon as it is published. Until an upgrade is applied, deploy a WAF or Patchstack vPatch rule that blocks path-traversal sequences (../, encoded variants, null bytes) and absolute paths in query/POST parameters handled by the theme, restrict outbound access and disable allow_url_include/allow_url_fopen in php.ini to prevent escalation to RFI, and tighten filesystem permissions so the web user cannot read wp-config.php or /etc paths if the inclusion is read-only. As a stronger compensating control, switch to an alternative theme until patched - the trade-off is loss of theme-specific design and customizations.