Skyward Theme CVE-2025-69164

The vulnerable Skyward WordPress theme version 1.10 or earlier must be installed and active on the target WordPress site, with the vulnerable include/require code path reachable over HTTP(S). Exploitation requires no authentication and no user interaction per the CVSS vector (PR:N/UI:N), but the AC:H rating indicates a non-default precondition - likely knowledge of the specific theme parameter accepting the file path, a successful path-traversal or wrapper bypass against any sanitization, and for full RCE, the presence of an attacker-controllable PHP file on the local filesystem (uploaded media, log file, session file, or temp file). Sites running Skyward versions newer than 1.10, or with the theme installed but inactive such that its endpoints are not registered, are not exposed.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H combined with the 8.1 base score indicates a high-severity, network-reachable, unauthenticated flaw with full CIA impact - significant on paper. However, AC:H signals that successful exploitation requires conditions outside the attacker's control (likely a specific request shape, traversal technique, or pre-existing file on disk), which tempers the practical risk. No EPSS score, KEV listing, or public POC has been provided, so this is not confirmed actively exploited and no public exploit code has been identified at time of analysis; given the small footprint of premium ThemeRex themes versus mass-market plugins, this is more likely targeted than opportunistic. The single Patchstack reference is the authoritative source; absence of an NVD CPE range for fixed versions and no vendor changelog in the input means the patched version cannot be independently confirmed from the data provided.

A remote unauthenticated attacker crafts an HTTP request to a vulnerable Skyward theme endpoint, supplying a path-traversal payload in the file-loading parameter to read sensitive files such as wp-config.php and exfiltrate database credentials. If the attacker can stage a PHP payload on the server first - for example through an unrestricted file-upload feature, a poisoned log file, or session file injection - the same LFI primitive can be chained into remote code execution under the web server's PHP user. No public exploit code has been identified at time of analysis, and the AC:H rating suggests a non-trivial trigger condition.