What is the CVSS score of CVE-2025-69158?

CVE-2025-69158 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Granola WordPress Theme are affected by CVE-2025-69158?

The ThemeREX Granola WordPress theme (through version 1.13) contains an unauthenticated file-access vulnerability that could expose sensitive site configuration and lead to complete system…

How to fix or mitigate CVE-2025-69158?

Within 24 hours: Identify all WordPress sites running ThemeREX Granola theme version 1.13 or earlier; deactivate or remove the theme from all installations. Within 7 days: Rotate all WordPress admin credentials and database passwords; review server and access logs for exploitation attempts; implement WAF rules blocking directory traversal patterns (../) and common LFI payloads; restrict administrative access by IP. Within 30 days: Migrate to alternative WordPress theme; monitor ThemeREX security advisories and apply patch immediately upon release; conduct full security audit of affected sites for prior compromise.

Granola WordPress Theme CVE-2025-69158

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Granola

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable LFI with confidentiality impact from arbitrary file read; integrity/availability impacts require additional log-poisoning chain not described, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:42 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Granola <= 1.13 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the ThemeREX Granola WordPress theme through version 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files via attacker-controlled path input. The flaw is reachable over the network without credentials or user interaction and can expose sensitive site files such as wp-config.php, potentially escalating to code execution if log-poisoning or session-file techniques are viable. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Granola is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:granola). The root cause is CWE-98, Improper Control of Filename for Include/Require Statement in PHP, meaning a PHP include()/require() call in the theme resolves its path from untrusted request input without canonicalization or allowlist checks. In WordPress themes this pattern typically appears in AJAX handlers, template loaders, or shortcode renderers that accept a 'file', 'template', or 'view' parameter and concatenate it into an include path, allowing directory traversal to any file readable by the web server user.

RemediationAI

Upstream fix availability is not independently confirmed from the supplied data; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/granola/vulnerability/wordpress-granola-theme-1-13-local-file-inclusion-vulnerability should be consulted for the patched release and operators should upgrade Granola to any version higher than 1.13 once published by ThemeREX. Until a patched build is installed, compensating controls include placing a WAF rule that blocks request parameters containing '../', null bytes, or absolute paths against theme endpoints, restricting PHP's open_basedir to the WordPress document root and uploads directory to bound any file read, and disabling allow_url_include and allow_url_fopen in php.ini to prevent remote inclusion variants - note that open_basedir can break plugins that legitimately read outside the webroot and WAF traversal rules generate false positives against pagebuilder URLs. If the theme cannot be patched promptly, switching to an alternative theme is the most reliable mitigation given that LFI in template code is hard to virtual-patch comprehensively.