What is the CVSS score of CVE-2025-69150?

CVE-2025-69150 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Medeus WordPress Theme are affected by CVE-2025-69150?

The Medeus WordPress theme versions 1.14 and earlier contain an unauthenticated file inclusion vulnerability that exposes sensitive configuration files including database credentials.

How to fix or mitigate CVE-2025-69150?

Within 24 hours: Identify all WordPress installations using Medeus theme version 1.14 or earlier; document affected systems and their locations. Within 7 days: Implement Web Application Firewall rules to block path traversal attempts and wp-config.php file access; verify wp-config.php is stored outside web root and has restricted file permissions (640 or more restrictive). Within 30 days: Execute migration to alternative actively maintained WordPress theme or apply vendor patch upon release.

Medeus WordPress Theme CVE-2025-69150

EUVD-2025-210173 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Medeus

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Unauthenticated network LFI with a non-obvious trigger (AC:H, PR:N); high confidentiality from wp-config.php disclosure, limited integrity via potential chain, no inherent availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:53 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.

AnalysisAI

Unauthenticated local file inclusion in the Medeus WordPress theme versions 1.14 and earlier allows remote attackers to coerce the PHP backend into including arbitrary files, exposing sensitive configuration data such as wp-config.php and potentially enabling code execution if log poisoning or uploaded content can be referenced. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require), affects a ThemeREX product tracked by Patchstack as a WordPress theme issue, and no public exploit identified at time of analysis. Despite the CVSS 8.1 high rating, AC:H signals non-trivial exploitation requirements beyond a simple parameter swap.

Technical ContextAI

Medeus is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:medeus). CWE-98 describes PHP code that passes attacker-controllable input into include(), require(), include_once(), or require_once() without proper validation, allowing the attacker to influence which file the PHP interpreter parses. In WordPress themes this commonly arises from AJAX handlers or template-loader logic that accepts a 'file', 'page', or 'template' parameter and concatenates it into a path; with PHP wrappers (php://filter, data://) or directory traversal sequences, an attacker can read source files, configuration data, or in some cases execute code by including remote/local content the application already trusts. Patchstack categorizes the issue with the LFI, Information Disclosure, and PHP tags, consistent with file-read primitives against the WordPress filesystem.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied references - the Patchstack advisory documents the issue up to and including 1.14 but does not cite a fixed version in the input data, so administrators should monitor the ThemeREX changelog and the Patchstack record at https://patchstack.com/database/wordpress/theme/medeus/vulnerability/wordpress-medeus-theme-1-14-local-file-inclusion-vulnerability for a release above 1.14. As compensating controls until a patched theme version ships, deploy a WAF rule that blocks include/template parameters containing '../', null bytes, or PHP stream wrappers (php://, data://, file://, expect://) against the theme's PHP endpoints under /wp-content/themes/medeus/, restrict outbound filesystem access via open_basedir scoped to the WordPress webroot, and rotate WordPress salts and database credentials in wp-config.php on any site that has been internet-exposed since the disclosure, since LFI of wp-config.php is the most likely first-stage outcome. Note that aggressive WAF rules may break legitimate template loading if the theme uses generic parameter names, so test in detection mode first; Patchstack's vPatch (if subscribed) or the use of an alternative WordPress security plugin can apply a virtual patch without modifying theme code.