What is the CVSS score of CVE-2025-69162?

CVE-2025-69162 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Grecko WordPress Theme are affected by CVE-2025-69162?

ThemeRex Grecko WordPress theme (versions 5.17 and earlier) contains an unauthenticated remote file inclusion vulnerability enabling attackers to steal sensitive data and compromise website integrity…

How to fix or mitigate CVE-2025-69162?

Within 24 hours: Complete inventory of WordPress deployments using ThemeRex Grecko theme version 5.17 or earlier. Within 7 days: Deploy web application firewall rules blocking file inclusion and path traversal attacks; if non-essential, disable the theme entirely. Within 30 days: Finalize migration to an alternative theme or evaluate risk acceptance if continued use is required; monitor vendor advisory channels for patch availability.

Grecko WordPress Theme CVE-2025-69162

EUVD-2025-210177 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Grecko

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated LFI in a WordPress theme; AC:H reflects the need to know filesystem paths or satisfy a state precondition; full C/I/A:H assumes inclusion can be turned into PHP execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:51 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Grecko <= 5.17 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Grecko WordPress theme versions 5.17 and earlier allows remote attackers to coerce the application into including arbitrary files from the server filesystem, potentially leading to sensitive file disclosure and PHP code execution where attacker-controlled content can be reached. The flaw is reachable without authentication over HTTP and was disclosed via Patchstack with no public exploit identified at time of analysis. CVSS is rated 8.1 with high attack complexity, indicating exploitation is feasible but not trivially automatable.

Technical ContextAI

Grecko is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:grecko). The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote File Inclusion / Local File Inclusion. In WordPress themes this class of bug typically arises when a PHP include()/require() statement consumes a value derived from a request parameter (often via admin-ajax.php, a theme shortcode handler, or a template-loading helper) without normalising the path or restricting it to an allowlist of expected templates. An attacker who controls that parameter can traverse the filesystem to include arbitrary local PHP files, configuration data, or - if log poisoning, session files, or uploadable content is reachable - convert disclosure into PHP code execution within the web server process.

RemediationAI

No vendor-released patched version is identified in the provided data, so administrators should consult the ThemeRex vendor portal and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/grecko/vulnerability/wordpress-grecko-theme-5-17-local-file-inclusion-vulnerability) for an updated build above 5.17 and upgrade as soon as one is published. In the interim, compensating controls include placing the site behind a WAF with rules that block directory-traversal sequences (../, encoded variants, php:// and data:// wrappers) on theme endpoints, hardening PHP by setting open_basedir to the WordPress document root and disabling allow_url_include, and restricting access to admin-ajax.php and theme template-loader endpoints by IP where feasible - note these controls may break legitimate theme features that legitimately load templates dynamically, so test before enforcing. Switching off the Grecko theme entirely is the most reliable mitigation if the site can tolerate it.