Preservation WordPress Theme CVE-2025-69144

Target must be a WordPress site with the ThemeREX Preservation theme version 1.10 or earlier installed and reachable over HTTP(S); no authentication, user interaction, or admin privileges are required per PR:N/UI:N. Limiting factors: AC:H indicates the vulnerable parameter and payload are not trivially discoverable (likely requiring specific encoding, a non-obvious endpoint, or particular request state), and escalation from file read to code execution further requires that PHP allow_url_include be enabled or that the attacker can place controlled content (uploaded media, poisoned logs, session files) at a path the include can reach. The flaw is theme-specific, so sites not running Preservation are not affected even if other ThemeREX themes are installed.

Signals are mixed: CVSS 8.1 with C:H/I:H/A:H suggests severe impact, but AC:H indicates non-trivial exploitation, likely because the vulnerable parameter, payload encoding, or auxiliary state is not obvious without analysis. Attack vector is network (AV:N) and unauthenticated (PR:N), which is the worst-case prerequisite combination for an internet-exposed WordPress site. No EPSS score, no CISA KEV listing, and no public PoC were provided, so this currently reads as a high-severity but not-yet-mass-exploited theme issue - comparable to other Patchstack-disclosed WordPress theme LFIs that frequently see opportunistic scanning once a PoC drops. The I:H and A:H ratings are aggressive for a pure LFI; they are likely justified only if the inclusion can be steered to attacker-controlled PHP (e.g., uploaded media, log files, or session files), which the description does not confirm - verify against the Patchstack advisory.

An unauthenticated attacker scans WordPress sites running the Preservation theme and sends a crafted HTTP request to a vulnerable theme endpoint with a path-traversal or absolute-path payload in the affected parameter, causing the PHP include to load /var/www/.../wp-config.php and leak database credentials and secret keys in the response. With those credentials the attacker pivots to the database or, if the inclusion can be aimed at an attacker-controlled file such as an uploaded image or a poisoned log, executes arbitrary PHP code. No public exploit identified at time of analysis, so the AC:H rating suggests some payload tuning is required.