Dom WordPress Theme CVE-2025-69146

The target WordPress site must have the ThemeREX 'Dom' theme installed and active at version 1.24 or earlier, and the specific vulnerable theme entry point (a PHP file reachable directly or via a theme-handled request parameter) must be network-reachable. No authentication or user interaction is required (PR:N/UI:N), but CVSS AC:H signals that the exploit depends on specific request conditions - likely a particular parameter name, path, or theme configuration - rather than a trivially reachable default. Exploitation is bounded by the PHP runtime's open_basedir, allow_url_include, and file-system permissions of the web server user.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H paints a serious but non-trivial picture: network reachable and unauthenticated, but with high attack complexity, suggesting the vulnerable code path requires specific conditions (e.g., a particular request shape, parameter, or theme feature being active). EPSS data is not provided in the input, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation; no public exploit identified at time of analysis. The Patchstack tags (LFI, Information Disclosure, PHP) are consistent with the CWE and indicate the immediate, realistic outcome is file disclosure rather than guaranteed RCE. Treat this as a medium-to-high operational priority for any WordPress site running the Dom theme - full triple-high impact justifies prompt action, but AC:H and the lack of public PoC reduce mass-exploitation likelihood relative to a typical drive-by WordPress flaw.

An unauthenticated attacker on the internet sends a crafted HTTP request to a vulnerable Dom theme endpoint, supplying a manipulated file/path parameter that the theme passes into a PHP include statement. The server loads attacker-controlled local files such as wp-config.php, exposing database credentials and WordPress secret keys; with a writable log or uploadable content vector this can escalate to arbitrary PHP execution in the web server context. No public PoC is referenced in the input, so an attacker would need to reverse-engineer the vulnerable parameter from the theme code, consistent with the CVSS AC:H rating.