What is the CVSS score of CVE-2025-69146?

CVE-2025-69146 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Dom WordPress Theme are affected by CVE-2025-69146?

The ThemeREX 'Dom' WordPress theme (versions through 1.24) contains an unauthenticated remote vulnerability that allows attackers to access sensitive files and potentially execute code on affected…

How to fix or mitigate CVE-2025-69146?

Within 24 hours: Inventory all WordPress installations using ThemeREX Dom theme version 1.24 or earlier. Within 7 days: Disable the theme in production, switch to an alternative WordPress theme, and review access logs for indicators of exploitation. Within 30 days: Complete migration to a secure alternative theme across all affected sites; implement file system permissions and WAF rules to block local file inclusion patterns.

Dom WordPress Theme CVE-2025-69146

EUVD-2025-210210 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Dom

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable PHP LFI with no auth or user interaction (AV:N/PR:N/UI:N); AC:H reflects required knowledge of vulnerable parameter; LFI can disclose secrets and enable RCE, giving C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:55 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Dom <= 1.24 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX 'Dom' WordPress theme through version 1.24 allows remote attackers to coerce the PHP application into including arbitrary local files, leading to sensitive information disclosure and potential code execution. No public exploit identified at time of analysis, but the CVSS 8.1 rating reflects high impact across confidentiality, integrity, and availability if a vulnerable include path is reached. The flaw is tracked by Patchstack and ENISA (EUVD-2025-210210) and affects all Dom theme versions up to and including 1.24.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly called PHP Remote/Local File Inclusion. The CPE cpe:2.3:a:themerex:dom:*:*:*:*:*:*:*:* identifies the affected component as the ThemeREX-developed 'Dom' commercial WordPress theme. In CWE-98 patterns, user-supplied input is passed - directly or after insufficient sanitisation - into PHP include/require statements, allowing the attacker to control which file is loaded by the interpreter. On a WordPress install this typically means traversal to read configuration files such as wp-config.php (exposing database credentials and auth keys) or, where log poisoning or uploaded content is reachable, escalation to arbitrary PHP execution within the web server context.

RemediationAI

Upstream fix availability is not independently confirmed from the supplied data; the Patchstack advisory should be consulted at https://patchstack.com/database/wordpress/theme/dom/vulnerability/wordpress-dom-theme-1-24-local-file-inclusion-vulnerability for any vendor-released patched version above 1.24, and the theme should be upgraded to that version as the primary remediation. Until a confirmed patched build is installed, deactivate the Dom theme and switch to a supported theme (this is disruptive and changes the site's appearance), or place a WAF rule (Patchstack, Wordfence, or ModSecurity) in front of WordPress to block requests containing path-traversal sequences (../, encoded variants) and suspicious file parameters targeting theme PHP entry points - note WAF rules can produce false positives on legitimate file-handling plugins. As a defence-in-depth measure, set PHP open_basedir to restrict include paths to the WordPress webroot and ensure allow_url_include is Off so the bug cannot escalate to remote inclusion.