What is the CVSS score of CVE-2025-69149?

CVE-2025-69149 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Top Dog are affected by CVE-2025-69149?

The ThemeRex Top Dog WordPress theme (version 1.0.5 and earlier) contains a vulnerability enabling unauthorized access to sensitive files on affected websites.

How to fix or mitigate CVE-2025-69149?

Within 24 hours: Inventory all WordPress installations using the ThemeRex Top Dog theme and identify those running version 1.0.5 or earlier. Within 7 days: Deactivate and replace the vulnerable theme with an alternative; implement Web Application Firewall rules to block file-inclusion attack patterns. Within 30 days: Monitor ThemeRex vendor announcements for patch availability; document implemented controls and plan migration strategy for when a patched version becomes available.

Top Dog CVE-2025-69149

EUVD-2025-210172 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Top Dog

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N) with AC:H for parameter and sink prerequisites; full C:H for arbitrary file read, but I/A only L absent a confirmed RCE sink.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:54 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Top Dog WordPress theme (versions <=1.0.5) allows remote attackers to coerce the application into including arbitrary local PHP files, potentially leading to sensitive data disclosure or code execution if a writable/loggable file can be referenced. The flaw is reachable without authentication or user interaction over the network, though CVSS marks attack complexity as high; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Top Dog is a commercial WordPress theme published by ThemeRex (CPE cpe:2.3:a:themerex:top_dog). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in a PHP Program), the classic 'PHP File Inclusion' weakness in which user-controlled input flows into a PHP include/require/include_once/require_once call without sufficient allowlist validation or path normalization. In WordPress themes this pattern typically appears in template loaders, AJAX handlers, or shortcode dispatchers that accept a 'view', 'template', 'file', or similar parameter and concatenate it into an include path, allowing traversal sequences or absolute paths to reach files outside the intended directory.

RemediationAI

No vendor-released patched version was provided in the supplied intelligence - consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/top-dog/vulnerability/wordpress-top-dog-theme-1-0-5-local-file-inclusion-vulnerability) for the fixed Top Dog release and upgrade to any version above 1.0.5 once published. Until a patched theme version is installed, deactivate the Top Dog theme and switch to a safe default theme, or place a WAF rule (Patchstack mitigation, Wordfence, ModSecurity OWASP CRS rule 930100/930110) in front of the site to block path-traversal sequences (../, %2e%2e, null bytes, php://, file://) on requests targeting theme endpoints; the trade-off is that aggressive traversal filtering can break legitimate file-path query parameters used by other plugins. Additionally restrict PHP open_basedir and disable allow_url_include in php.ini to reduce post-inclusion impact, accepting that open_basedir can break plugins that legitimately read outside the document root.