What is the CVSS score of CVE-2025-69163?

CVE-2025-69163 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WineShop WordPress Theme are affected by CVE-2025-69163?

The WineShop WordPress theme (versions 3.17 and earlier) contains an unauthenticated Local File Inclusion vulnerability enabling remote attackers to read and execute arbitrary server files without…

How to fix or mitigate CVE-2025-69163?

24 hours: Inventory all WordPress installations using WineShop theme v3.17 or earlier; immediately deactivate the theme and deploy an alternative. 7 days: Implement Web Application Firewall (WAF) rules to block file inclusion patterns (../, php://, file://); review access logs for exploitation attempts from the past 30 days. 30 days: Upgrade to WineShop theme v3.18+ once vendor releases the patch; conduct security audit of affected servers for unauthorized file access or data exfiltration.

WineShop WordPress Theme CVE-2025-69163

EUVD-2025-210178 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Wineshop

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N) with AC:H reflecting non-trivial conditions; C:H for file disclosure, I:L/A:L since RCE escalation is not confirmed in available data.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:50 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in WineShop <= 3.17 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the WineShop WordPress theme versions 3.17 and earlier allows remote attackers to include and execute arbitrary local files on the server via crafted requests. The flaw stems from improper control of filename for include/require (CWE-98) and carries a CVSS 8.1 (High) with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis.

Technical ContextAI

WineShop is a commercial WordPress theme developed by ThemeREX (CPE: cpe:2.3:a:themerex:wineshop) targeting wine shop and e-commerce sites. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, a.k.a. PHP Remote File Inclusion), meaning user-controlled input is passed unsanitized into a PHP include() or require() call. In WordPress theme contexts this typically arises from AJAX handlers, theme template loaders, or shortcode parameters that accept a file path or template name from request data. Once a local path is included, the PHP interpreter executes it, which can be chained with log poisoning, PHP session files, or uploaded media to achieve code execution beyond simple file disclosure.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/wineshop/vulnerability/wordpress-wineshop-theme-3-17-local-file-inclusion-vulnerability) lists affected versions as ≤3.17 without naming a fixed release. Site operators should monitor ThemeREX for a patched theme version above 3.17 and apply it immediately when published. As compensating controls, deploy a WordPress WAF rule (Patchstack, Wordfence, or ModSecurity) to block requests containing directory-traversal patterns (../, %2e%2e, php://, file://) against theme endpoints, restrict PHP open_basedir to the WordPress document root to limit file inclusion scope (side effect: may break plugins that legitimately access /tmp or shared paths), disable allow_url_include in php.ini to prevent escalation to RFI, and consider temporarily switching to a default WordPress theme on high-risk sites until a fix ships.