What is the CVSS score of CVE-2025-69161?

CVE-2025-69161 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Snowy WordPress Theme are affected by CVE-2025-69161?

The Snowy WordPress theme by ThemeREX (versions ≤1.13) contains an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that exposes organizations to unauthorized server file access.

How to fix or mitigate CVE-2025-69161?

Within 24 hours: Audit all WordPress sites to identify Snowy theme installations and document which versions are deployed. Within 7 days: Deactivate the vulnerable theme, migrate to an alternative theme, and validate theme removal from the server. Within 30 days: Conduct file access log review to detect past exploitation attempts and implement preventive WordPress hardening controls.

Snowy WordPress Theme CVE-2025-69161

EUVD-2025-210233 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Snowy

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress endpoint with no authentication (AV:N/PR:N/UI:N); AC:H reflects the non-trivial payload construction implied for LFI-to-impact; PHP include yields full read and code-execution impact (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:39 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Snowy <= 1.13 versions.

AnalysisAI

Unauthenticated local file inclusion in the Snowy WordPress theme (ThemeREX) versions up to and including 1.13 allows remote attackers to coerce the PHP runtime into including arbitrary files from the server filesystem. The flaw is tracked as CWE-98 (Improper Control of Filename for Include/Require), reported by Patchstack, and carries a CVSS 3.1 score of 8.1 (High) reflecting high-complexity but unauthenticated network exploitation. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Snowy is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:snowy). The underlying weakness is CWE-98, which describes PHP code that passes attacker-influenced input into include/require statements without adequate filename validation. In a WordPress theme context this typically manifests through AJAX handlers, template-loader endpoints, or shortcode/AJAX dispatchers that take a 'template', 'view', 'file', or similar parameter and concatenate it into an include path. Because PHP's include directive resolves traversal sequences and stream wrappers, an attacker who can reach the vulnerable handler may read or execute server-side PHP files outside the intended directory.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory (https://patchstack.com/database/wordpress/theme/snowy/vulnerability/wordpress-snowy-theme-1-13-local-file-inclusion-vulnerability) documents the issue against Snowy ≤1.13 but no fixed version is supplied in this intelligence, so administrators should check the ThemeREX vendor page for an updated build above 1.13 and upgrade as soon as one is released. Until a patched build exists, the most effective compensating controls are deactivating the Snowy theme and switching to an alternative (full mitigation but breaks the site's appearance), or placing a WAF rule in front of WordPress that blocks requests containing directory-traversal sequences (../, %2e%2e%2f), absolute paths, and PHP stream wrappers (php://, file://, data://, expect://) targeting Snowy's AJAX and template endpoints under /wp-content/themes/snowy/ - this preserves functionality but can be bypassed by novel encodings. Hardening PHP via open_basedir and disabling allow_url_include reduces the blast radius from arbitrary code execution to local file disclosure but does not eliminate the bug.