WineShop WordPress Theme CVE-2025-69163

Exploitation requires a target WordPress site running the ThemeREX WineShop theme at version 3.17 or earlier as the active theme, with the vulnerable theme endpoint reachable over HTTP/HTTPS. No authentication, user interaction, or admin role is needed (PR:N/UI:N), but the CVSS AC:H rating indicates a non-trivial condition - likely specific encoding, path traversal sequence, or chaining with a writable file (log, session, or upload) to reach high-impact outcomes such as code execution. Sites where the theme is installed but inactive, or where PHP allow_url_include is disabled and open_basedir restricts file access, face significantly reduced impact.

The CVSS 3.1 score of 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N reflects a remotely reachable, unauthenticated flaw with high attack complexity and full CIA impact - consistent with LFI that requires some condition (e.g., specific parameter, encoding, or null byte handling) to be met. The high attack complexity (AC:H) and the lack of any public PoC or CISA KEV entry suggest this is not currently a mass-exploitation target, but the unauthenticated nature (PR:N) on a public-facing WordPress theme makes it attractive once exploitation details surface via the Patchstack advisory. EPSS data and POC availability are not provided in the input, so probability of exploitation cannot be numerically quantified. The CVSS-stated A:H (availability impact) is somewhat aggressive for a pure LFI primitive; verify with the Patchstack advisory whether RCE escalation is demonstrated.

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable WineShop theme endpoint with a manipulated file or template parameter pointing at a sensitive local path (e.g., wp-config.php or /etc/passwd) or at attacker-controlled content placed in logs, uploads, or session files. Successful inclusion discloses credentials and database secrets and, when chained with log poisoning or uploaded media containing PHP, results in code execution as the web server user. No public exploit identified at time of analysis, but Patchstack disclosure typically precedes scanner signatures within days.