What is the CVSS score of CVE-2025-69160?

CVE-2025-69160 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Gita Theme are affected by CVE-2025-69160?

The ThemeRex Gita WordPress theme (versions 1.11 and earlier) contains an unauthenticated file-inclusion vulnerability allowing remote attackers to access website configuration files containing…

How to fix or mitigate CVE-2025-69160?

Within 24 hours: Inventory all WordPress installations running ThemeRex Gita (identify version numbers) and review web server access logs for suspicious requests containing path traversal patterns or file:// protocol attempts. Within 7 days: Deactivate and remove ThemeRex Gita theme from all installations; deploy an alternative theme or monitor Patchstack advisories for patch release timeline; rotate WordPress database credentials if any suspicious access detected. Within 30 days: Deploy Web Application Firewall rules (ModSecurity, Cloudflare WAF, or AWS WAF) to block path traversal and file inclusion patterns; implement file integrity monitoring on wp-config.php; conduct database access log audit for evidence of unauthorized queries.

Gita Theme CVE-2025-69160

EUVD-2025-210176 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Gita

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.5 MEDIUM

Unauthenticated network LFI with AC:H per reporter; primary impact is file disclosure (C:H), limited integrity via log/credential abuse (I:L), no direct availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:52 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Gita <= 1.11 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Gita WordPress theme versions 1.11 and earlier allows remote attackers to include arbitrary local files via a PHP file-inclusion weakness (CWE-98), potentially exposing wp-config.php credentials and enabling further compromise. No public exploit identified at time of analysis, but the vulnerability is network-reachable without authentication and has been disclosed by Patchstack with a CVSS 3.1 base score of 8.1.

Technical ContextAI

Gita is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:gita). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. This class of bug arises when user-controlled input reaches a PHP include(), require(), include_once(), or require_once() call without strict allowlisting, letting attackers traverse the filesystem and include arbitrary local PHP files - frequently abused in WordPress themes that load template fragments based on request parameters. Successful inclusion of files such as wp-config.php discloses database credentials and authentication salts, and inclusion of attacker-controllable files (uploads, log files) can escalate LFI into code execution.

RemediationAI

No vendor-released patched version is identified in the available data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/gita/vulnerability/wordpress-gita-theme-1-11-local-file-inclusion-vulnerability) and the ThemeRex vendor portal for a fixed release above 1.11 and upgrade immediately when available. Until a patched version is confirmed, compensating controls include deactivating and removing the Gita theme in favor of an unaffected theme (which will break the current site appearance), placing the site behind a WAF rule that blocks path-traversal sequences (../, encoded variants, php://, file://) and known WordPress LFI parameter patterns (trade-off: may break legitimate template requests and requires tuning), restricting filesystem permissions so the PHP process cannot read wp-config.php beyond what WordPress needs, rotating database credentials and WordPress salts in case prior exfiltration occurred, and monitoring web server logs for anomalous GET parameters resolving to PHP paths.