Top Dog CVE-2025-69149

Target must be a WordPress site with the ThemeRex Top Dog theme installed and active at version 1.0.5 or earlier; the vulnerable include path must be reachable over HTTP(S) without authentication (PR:N, UI:N). The CVSS AC:H value indicates exploitation is gated by non-default factors - likely knowledge of the specific theme parameter that flows into the include sink and successful traversal to a file whose content PHP will interpret; achieving the I:H/A:H impact additionally requires a writable or attacker-influenceable local file (log, session, upload) to convert disclosure into code execution. Defenders should treat sites that have disabled file uploads, restricted open_basedir, or disabled the affected theme template as materially lower risk.

The CVSS 8.1 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H signals a network-reachable, unauthenticated bug with full CIA impact but elevated attack complexity - the AC:H value suggests non-trivial preconditions (a specific request shape, race, or environmental dependency) rather than a turnkey exploit. There is no CISA KEV listing and no public exploit identified at time of analysis, and the absence of an EPSS score in the provided data means widespread-exploitation likelihood cannot be quantified here. The 'I:H/A:H' impact bits are notable for a pure LFI: they imply the analyst expects the inclusion to be leveraged into code execution (e.g., via log poisoning, session files, or uploaded media), which should be verified against the Patchstack advisory because raw LFI without an execution sink typically warrants only C:H. Net assessment: a credible high-severity risk for any site running the affected theme, but prioritization below KEV-listed WordPress bugs unless Patchstack publishes evidence of in-the-wild abuse.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable Top Dog theme endpoint with a manipulated file/template parameter containing path traversal sequences, causing the PHP include statement to load an attacker-chosen local file such as wp-config.php (for database credentials) or a previously poisoned log/session/upload file containing PHP payloads. Because CVSS reports I:H/A:H, a realistic chain pivots the inclusion into code execution by combining it with a writable local sink (e.g., poisoned access log, image with embedded PHP, /tmp session). No public exploit identified at time of analysis, and the AC:H rating implies the attacker must satisfy a specific condition (parameter discovery, traversal depth, or content seeding) before the inclusion succeeds.