What is the CVSS score of CVE-2025-69145?

CVE-2025-69145 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Gat WordPress Theme are affected by CVE-2025-69145?

The Gat WordPress theme (versions 1.16 and earlier) contains an unauthenticated file inclusion vulnerability (CVSS 8.1) that allows attackers to access sensitive configuration files and credentials…

How to fix or mitigate CVE-2025-69145?

24 hours: Identify all WordPress sites running Gat theme v1.16 or earlier and disable the theme immediately. 7 days: Implement temporary mitigation through Web Application Firewall rules blocking local file inclusion patterns and verify no unauthorized file access in server logs. 30 days: Replace the Gat theme with a patched alternative or await vendor security update; conduct credential rotation for any accounts potentially exposed through config file access.

Gat WordPress Theme CVE-2025-69145

EUVD-2025-210231 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Gat

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N) with AC:H reflecting non-trivial exploitation; primary impact is file disclosure (C:H), with integrity/availability only low absent confirmed RCE chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:40 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Gat <= 1.16 versions.

AnalysisAI

Unauthenticated local file inclusion in the Gat WordPress theme (versions 1.16 and earlier) allows remote attackers to include arbitrary local files on the server, potentially leading to disclosure of sensitive configuration data, credentials, or remote code execution if combined with uploadable content. No public exploit identified at time of analysis, but the CVSS 8.1 rating reflects high confidentiality, integrity, and availability impact. The vulnerability is reported by Patchstack and affects the ThemeRex Gat theme.

Technical ContextAI

The Gat theme is a commercial WordPress theme published by ThemeRex (CPE: cpe:2.3:a:themerex:gat). The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. This class of bug arises when user-controlled input is passed directly into PHP include(), require(), include_once(), or require_once() statements without proper sanitization or allowlisting, enabling attackers to traverse the filesystem and load arbitrary PHP files. In WordPress themes, this typically manifests in AJAX handlers, template loaders, or shortcode processors that accept a file or path parameter from HTTP requests.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory does not specify a fixed version, so administrators should monitor ThemeRex for a Gat release greater than 1.16 and upgrade as soon as one is available, referencing https://patchstack.com/database/wordpress/theme/gat/vulnerability/wordpress-gat-theme-1-16-local-file-inclusion-vulnerability for updates. Until a patched version ships, the most reliable compensating control is to deactivate and remove the Gat theme and switch to a maintained alternative, accepting the visual/UX disruption that entails. If removal is not feasible, deploy a Web Application Firewall rule (Patchstack, Wordfence, or equivalent) to block requests containing directory traversal sequences (../, ..%2f, php://, file://, data://) targeting Gat theme endpoints, and restrict PHP open_basedir and allow_url_include = Off in php.ini to reduce LFI blast radius - noting these hardening steps may break legitimate plugins that rely on dynamic includes.