Gat WordPress Theme CVE-2025-69145

Exploitation requires that the target WordPress site has the ThemeRex Gat theme installed and active at version 1.16 or earlier, and that the vulnerable theme endpoint is reachable from the attacker's network position (CVSS AV:N, PR:N - no authentication required). The AC:H rating signals that successful exploitation depends on specialized request crafting or non-default conditions not detailed in the public advisory - possibly specific PHP wrapper support (php://filter, allow_url_include), particular file paths being predictable, or a multi-step interaction. No user interaction is required (UI:N), and exploitation is constrained to sites actually running the Gat theme, which limits the addressable target population versus a WordPress-core flaw.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, unauthenticated exploitation with high impact across all three CIA properties, but with high attack complexity - suggesting non-trivial conditions such as specific request crafting, encoding bypasses, or timing. No EPSS score, KEV listing, or public POC has been provided, so real-world exploitation pressure appears low at this time. However, WordPress themes are a perennial high-volume target, and LFI flaws are frequently chained with log poisoning, session file inclusion, or wp-config.php disclosure to achieve RCE - meaning this should be patched promptly even absent observed in-the-wild use. The AC:H rating tempers the urgency relative to a trivially exploitable LFI, but unauthenticated reach plus high integrity impact still places this in the priority remediation tier for any site running the Gat theme.

An unauthenticated remote attacker identifies a WordPress site running the Gat theme and sends a crafted HTTP request to a vulnerable theme endpoint with a manipulated file or path parameter pointing to a sensitive local file such as wp-config.php or /etc/passwd. Because exploitation is rated AC:H, the attacker may need to satisfy non-default conditions (specific parameter encoding, multi-step request, or interaction with PHP session/log files) to succeed. A successful read of wp-config.php discloses database credentials and WordPress auth keys, which the attacker then uses to pivot to full administrative compromise of the site.