Gita Theme CVE-2025-69160

The target WordPress site must have the ThemeRex Gita theme installed and activated at version 1.11 or earlier, and the vulnerable theme endpoint that performs the unsafe PHP include must be reachable over HTTP/HTTPS by the attacker. No authentication and no user interaction are required (PR:N/UI:N), but the CVSS AC:H rating indicates the attacker must satisfy a non-trivial precondition - likely a specific request parameter, file path encoding, or theme configuration - that is not enumerated in the public Patchstack summary. Exploitation is limited to deployments still using Gita ≤1.11; sites that have switched themes, sites where the vulnerable include path is blocked by a WAF or open_basedir restriction, and hosts where the PHP process cannot read sensitive files are out of scope.

Signals are mixed. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 (High) and reflects an unauthenticated network-reachable issue with full CIA impact, but AC:H indicates non-trivial exploitation conditions that the public description does not enumerate. The advisory is not in CISA KEV, no EPSS score was provided in the input, and no SSVC decision data is available, so widespread automated exploitation cannot be confirmed. The C:H/I:H/A:H impact triad is unusually high for a pure LFI and likely assumes chained outcomes (credential disclosure leading to admin takeover or RCE via log/upload poisoning) rather than the read-only file exposure the CWE alone implies - defenders should treat this as a credible WordPress theme compromise vector but verify real impact against their deployment.

A remote attacker scans the public internet for WordPress sites running the Gita theme, then issues a crafted HTTP request to a vulnerable Gita endpoint with a parameter pointing at /wp-config.php (or via path traversal to /etc/passwd), causing the theme to include and disclose the file contents. The attacker uses the recovered database credentials and authentication keys to forge admin sessions or pivot to the database, achieving full site takeover; no public exploit is identified at time of analysis but the CWE-98 pattern is well understood and trivially weaponized once the vulnerable parameter is known.