Gamic WordPress Theme CVE-2025-69157

The target WordPress site must have the ThemeRex Gamic theme installed and active at version 1.15 or earlier, and the vulnerable theme endpoint must be reachable over HTTP/HTTPS (no authentication is required per CVSS PR:N). The CVSS AC:H rating implies meaningful limiting factors - likely that the attacker must know or brute-force the specific parameter name and supply a payload that bypasses partial filtering, and escalation from file disclosure to code execution further requires a PHP server configuration where allow_url_include is enabled or where an attacker-controlled file (log, session, upload) exists at a predictable path. Sites that have replaced or deactivated the Gamic theme, or that enforce strict open_basedir/WAF rules against traversal sequences, are not exploitable through this vector.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, 8.1 High) describes an unauthenticated network-reachable bug with high attack complexity and full CIA impact, which is consistent with an LFI that under some configurations can yield code execution but requires non-trivial conditions (e.g., reaching an includable sink, controlling log/session content, or chaining a wrapper). EPSS data was not provided, the vulnerability is not on the CISA KEV list, and no POC reference was supplied, so real-world risk is currently driven by exposure (any internet-facing WordPress site running this theme) rather than confirmed mass exploitation. The single reference is a Patchstack advisory; no independent NVD CPE breadth, exploit code, or vendor advisory URL is provided, so some operational details (exact vulnerable parameter, patched version) must be verified directly with ThemeRex or Patchstack before relying on the assessment.

An unauthenticated attacker sends a crafted HTTP GET request to a Gamic theme endpoint with a path-traversal payload in the vulnerable parameter (for example .../../../../wp-config.php or a php:// wrapper), causing the PHP include sink to read and return the file contents. The attacker harvests database credentials and WordPress secret keys from wp-config.php, then optionally chains the LFI with log or session file poisoning to achieve code execution. No public exploit was identified at time of analysis.