Printo WordPress Theme CVE-2025-69159

The target site must have the ThemeRex Printo theme installed and active at version 1.11 or earlier, and the vulnerable PHP file-inclusion endpoint must be reachable over HTTP/HTTPS (the standard WordPress front-end). No authentication, no user interaction, and no privileged role are required (PR:N/UI:N). Limiting factors: AC:H in the CVSS vector indicates non-trivial request shaping is needed (likely a specific parameter name plus traversal or null-byte/encoding trick, and possibly a non-default Printo configuration option); the public advisory does not disclose the exact parameter, so attackers must either purchase Patchstack details or reverse-engineer the theme; achieving RCE rather than mere file read additionally requires that the attacker can stage attacker-controlled PHP content on the filesystem (e.g., via media upload, log poisoning, or session files) and that PHP configuration (allow_url_include, open_basedir) does not prevent inclusion.

Signals are mixed and require balancing. CVSS 3.1 is 8.1 with AV:N/PR:N/UI:N (network-reachable, no auth, no user interaction) and C:H/I:H/A:H, which would normally make this a top-priority issue; however AC:H indicates the vendor or Patchstack assessed non-trivial preconditions (likely a specific parameter shape, file path traversal trick, or that the vulnerable endpoint is only exercised under certain theme configurations). No EPSS score, SSVC decision, KEV listing, or public PoC was supplied, so real-world exploitation pressure is currently unmeasured. The lone reference is the Patchstack advisory, which is a credible third-party WordPress vulnerability source but is not a vendor confirmation; affected-version data (≤1.11) likewise originates from Patchstack/EUVD rather than ThemeRex directly. Net assessment: treat as a high-priority WordPress supply-chain issue for any site running Printo, but recognize that AC:H plus the niche theme footprint likely means targeted rather than mass exploitation.

An unauthenticated attacker scans the internet for WordPress sites running the Printo theme (fingerprintable via /wp-content/themes/printo/ assets) and sends a crafted HTTP request to the vulnerable PHP endpoint with a path parameter pointing at a sensitive file such as wp-config.php, /etc/passwd, or a previously uploaded malicious file. Successful inclusion of wp-config.php leaks database credentials and WordPress auth keys, enabling full site takeover; if the attacker can plant PHP content in a writable location (uploads, log files) and include it, the result is remote code execution as the web-server user. No public exploit was identified at time of analysis, but CWE-98 patterns in WordPress themes are well understood and easily weaponized once the vulnerable parameter is known.