What is the CVSS score of CVE-2025-69157?

CVE-2025-69157 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Gamic WordPress Theme are affected by CVE-2025-69157?

The ThemeRex Gamic WordPress theme (versions 1.15 and earlier) contains an unauthenticated local file inclusion vulnerability that enables remote attackers to read arbitrary server files, including…

How to fix or mitigate CVE-2025-69157?

Within 24 hours: Inventory all WordPress installations for ThemeRex Gamic theme via admin dashboard (Appearance → Themes) and document version numbers; verify whether versions 1.15 or earlier are deployed. Within 7 days: Deactivate and uninstall ThemeRex Gamic; migrate to maintained alternative theme (e.g., Neve, OceanWP, or WordPress default theme); test functionality post-migration. Within 30 days: Rotate WordPress database credentials, authentication salts, and nonce keys in wp-config.php; review web server access and error logs for exploitation indicators; execute full security scan using WordPress security plugins (e.g., Wordfence, Sucuri) to detect backdoors or unauthorized access.

Gamic WordPress Theme CVE-2025-69157

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Gamic

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated (AV:N/PR:N/UI:N); AC:H because LFI-to-RCE requires non-default conditions; confidentiality high (file disclosure), integrity/availability only low absent confirmed RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:42 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.

AnalysisAI

Local file inclusion in the ThemeRex Gamic WordPress theme versions 1.15 and earlier allows unauthenticated remote attackers to coerce the PHP application into including arbitrary files via crafted parameters. Successful exploitation can expose sensitive configuration data (including wp-config.php) and, depending on server configuration, may escalate to remote code execution through log poisoning or session-file inclusion. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.

Technical ContextAI

Gamic is a commercial WordPress theme distributed by ThemeRex and used to build gaming/community sites. The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a user-controlled value reaches a PHP include/require call without sufficient sanitization or allow-listing. CPE cpe:2.3:a:themerex:gamic:*:*:*:*:*:*:*:* indicates all 1.x branches up to 1.15 are in scope. Although the CWE name references RFI, in modern PHP deployments allow_url_include is typically disabled, so the practical exploitation is local file inclusion against files already present on the web server.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed in the supplied data, so administrators should consult the Patchstack entry at https://patchstack.com/database/wordpress/theme/gamic/vulnerability/wordpress-gamic-theme-1-15-local-file-inclusion-vulnerability and upgrade Gamic to the version above 1.15 listed there once verified with ThemeRex. Until a confirmed patched build is installed, deploy a WAF rule (Patchstack vPatch, Wordfence, or equivalent) that blocks requests containing path-traversal sequences ('../', encoded variants) or absolute paths in theme-handled query parameters, ensure php.ini has allow_url_include=Off and open_basedir restricting PHP to the WordPress directory tree (note: open_basedir can break plugins that legitimately access /tmp), and restrict read permissions on wp-config.php and log/session directories that an LFI could weaponize. If the site does not strictly need this theme, switching themes is the cleanest mitigation.