What is the CVSS score of CVE-2025-69148?

CVE-2025-69148 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Quirky WordPress Theme are affected by CVE-2025-69148?

The ThemeREX Quirky WordPress theme (versions 1.23 and earlier) contains a critical vulnerability allowing unauthenticated attackers to read arbitrary files from affected servers.

How to fix or mitigate CVE-2025-69148?

Within 24 hours: Inventory all WordPress installations using ThemeREX Quirky version 1.23 or earlier; disable the theme on non-critical systems if possible. Within 7 days: Deploy Web Application Firewall (WAF) rules blocking local file inclusion patterns; subscribe to vendor security advisories for patch notifications. Within 30 days: Apply vendor patch once released, or execute full migration to an alternative theme if no patch timeline is announced.

Quirky WordPress Theme CVE-2025-69148

EUVD-2025-210232 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Quirky

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects non-trivial preconditions for RCE; confidentiality high for file disclosure, integrity/availability low absent confirmed code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:40 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Quirky WordPress theme versions 1.23 and earlier allows remote attackers to include and disclose arbitrary local files on the server. The flaw stems from improper control of filename for include/require statements (CWE-98), which can escalate to remote code execution if attackers can plant or reach an includable PHP payload. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Quirky is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:quirky:*). The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a PHP include/require path is constructed from attacker-controlled input without proper validation. In WordPress themes this pattern typically occurs in AJAX handlers, template-loader endpoints, or shortcode handlers that take a 'file', 'template', or 'view' parameter and pass it into include/require, allowing path traversal to arbitrary local PHP or sensitive configuration files such as wp-config.php.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/quirky/vulnerability/wordpress-quirky-theme-1-23-local-file-inclusion-vulnerability does not cite a fixed version, so administrators should monitor ThemeREX for an update beyond 1.23 and apply it as soon as released. As compensating controls, restrict access to the theme's PHP endpoints via web server rules or a WAF (Patchstack and Wordfence both provide virtual patches for theme LFIs), set open_basedir and disable allow_url_include in php.ini to constrain include() targets, and harden file permissions on wp-config.php and other sensitive files - note these mitigations may break theme features that legitimately load template files dynamically. If the theme is unmaintained, the most defensible action is to switch to an actively maintained theme.