Grecko WordPress Theme CVE-2025-69162

The target site must be running the ThemeRex Grecko WordPress theme at version 5.17 or earlier with the vulnerable include path reachable over HTTP (PR:N, UI:N per CVSS). High attack complexity (AC:H) indicates a meaningful limiter: exploitation likely depends on knowing or discovering the absolute on-disk path of the file to include, or on the theme being in a specific runtime state (e.g., a particular page template active, a specific shortcode rendered, or an admin-ajax action exposed without nonce). Conversion of file disclosure into code execution further requires that the attacker can place PHP-parseable content somewhere on the server's filesystem (uploads directory, log files with poisonable user-agent strings, session storage), which is not guaranteed on hardened installs.

The signals are mixed and should be read carefully. The CVSS 3.1 vector AV:N/AC:L… wait - the published vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so exploitation is network-reachable and unauthenticated but flagged as high complexity, which usually means the attacker must win a race, know specific filesystem layout, or satisfy a non-default precondition. There is no EPSS score, no CISA KEV listing, and no public PoC referenced in the provided data, so this is not currently confirmed actively exploited. Against that, full C/I/A:H is plausible for an LFI that reaches executable PHP, and WordPress themes are mass-scanned by opportunistic actors once a Patchstack advisory is published, so latent risk is meaningful. Net: treat as a high-priority patch on any internet-facing site running Grecko ≤5.17, but it does not warrant emergency out-of-band response without further evidence of in-the-wild activity.

A remote attacker scanning WordPress sites identifies one running the Grecko theme ≤5.17 and issues a crafted HTTP request to the vulnerable theme parameter, supplying a traversal path that points to wp-config.php or another sensitive PHP file. The server includes the file, leaking database credentials or, if the attacker can stage attacker-controlled content elsewhere on the host (uploaded media, poisoned logs), executing arbitrary PHP in the web server context. The AC:H rating suggests the attacker must first satisfy a non-trivial precondition such as knowing the absolute filesystem path or winning a state-dependent code path.