What is the CVSS score of CVE-2025-69147?

CVE-2025-69147 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Putter WordPress Theme are affected by CVE-2025-69147?

The ThemeREX Putter WordPress theme (versions 1.17 and earlier) contains an unauthenticated remote file inclusion vulnerability that allows attackers to extract sensitive files from web servers…

How to fix or mitigate CVE-2025-69147?

24 hours: Identify all WordPress installations using ThemeREX Putter theme version 1.17 and earlier. 7 days: Deactivate and remove the vulnerable theme from all installations; replace with alternative theme; review web server access logs for exploitation attempts. 30 days: Monitor vendor and Patchstack for patch availability; conduct security audit of potentially compromised systems; when patch is released, evaluate and deploy to prevent reinfection.

Putter WordPress Theme CVE-2025-69147

EUVD-2025-210171 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Putter

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress endpoint, no auth or UI needed, but AC:H reflects required knowledge of the vulnerable parameter; CWE-98 LFI plausibly yields full CIA impact via PHP wrappers.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:54 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Putter <= 1.17 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Putter WordPress theme versions 1.17 and earlier allows remote attackers to read arbitrary files from the underlying web server and, in PHP environments where include wrappers are abused, potentially achieve code execution. The flaw is reachable without authentication or user interaction, though CVSS reports high attack complexity. No public exploit identified at time of analysis, but Patchstack has published the advisory.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP), a classic PHP file inclusion weakness where user-controlled input flows into an include(), require(), or similar statement without proper allowlisting or path normalization. The affected component is the Putter commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:putter), which-like many WordPress themes-uses PHP template loading routines that can become dangerous when a parameter is passed unchecked to a filesystem call. Successful exploitation lets the attacker traverse the filesystem (e.g., reading wp-config.php for database credentials and auth keys) and, depending on PHP configuration (allow_url_include, log poisoning, session file inclusion, phar://), may escalate from arbitrary file read to remote code execution.

RemediationAI

No fixed version is listed in the provided intelligence, so the current guidance is: Patch available per vendor advisory - consult the Patchstack entry (https://patchstack.com/database/wordpress/theme/putter/vulnerability/wordpress-putter-theme-1-17-local-file-inclusion-vulnerability) for any updated theme release from ThemeREX above 1.17 and upgrade immediately. Until a confirmed fixed version is installed, mitigate by deploying a WordPress WAF or Patchstack's virtual patch (which is the typical delivery channel for this advisory), restricting access to the vulnerable theme endpoint via web-server rules, and hardening PHP (disable allow_url_include, set open_basedir to the WordPress root, and disable dangerous stream wrappers like phar://) - these controls reduce arbitrary read and RCE risk but will not stop targeted LFI of files inside open_basedir such as wp-config.php, so treat them as bridging measures, not fixes. Switching to a different theme is the most reliable workaround if the vendor has not released an update.