What is the CVSS score of CVE-2025-69164?

CVE-2025-69164 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Skyward Theme are affected by CVE-2025-69164?

ThemeRex Skyward WordPress theme (versions 1.10 and earlier) contains an unauthenticated remote file inclusion vulnerability enabling arbitrary PHP code execution, creating exposure to complete…

How to fix or mitigate CVE-2025-69164?

24 hours: Inventory all WordPress installations using ThemeRex Skyward theme, document versions, and review server access logs for exploitation attempts. 7 days: Disable ThemeRex Skyward theme across all affected sites and migrate to an alternative theme; if immediate migration is infeasible, implement WAF rules blocking requests to the theme directory. 30 days: Once vendor releases a patched version, apply the update to all systems and conduct forensic review of compromised instances for evidence of unauthorized access or data exfiltration.

Skyward Theme CVE-2025-69164

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Skyward

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint, no auth or user interaction; AC:H reflects required traversal/wrapper technique and file-staging for RCE; full CIA impact via LFI-to-RCE on web server context.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:41 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.

AnalysisAI

Unauthenticated local file inclusion in ThemeRex Skyward WordPress theme versions 1.10 and earlier allows remote attackers to include and execute arbitrary local PHP files on the server, enabling sensitive file disclosure and potential remote code execution. The flaw is reachable without authentication over the network and no public exploit has been identified at time of analysis, though Patchstack has catalogued the issue in their vulnerability database. CVSS rates the impact as 8.1 (High) reflecting full confidentiality, integrity, and availability compromise despite high attack complexity.

Technical ContextAI

Skyward is a commercial WordPress theme published by ThemeRex (CPE cpe:2.3:a:themerex:skyward). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly known as PHP Remote/Local File Inclusion. This class of bug occurs when a PHP include(), require(), include_once(), or require_once() statement uses user-controlled input to build a filesystem path without proper allow-listing or sanitization. In WordPress theme contexts, this typically manifests through AJAX handlers, shortcode parameters, or template-loading routines that accept a 'file', 'template', 'page', or similar parameter from a request and pass it to an include statement, allowing path traversal sequences or local PHP files (including uploaded media or log files) to be executed in the theme's PHP context.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version is not independently confirmed in the provided data, so administrators should consult the ThemeRex changelog or Patchstack record at https://patchstack.com/database/wordpress/theme/skyward/vulnerability/wordpress-skyward-theme-1-10-local-file-inclusion-vulnerability and upgrade to any version greater than 1.10. Until a confirmed patched version is installed, compensating controls include deploying a WordPress-aware WAF such as Patchstack, Wordfence, or ModSecurity with WordPress core rules to block path traversal sequences (../, %2e%2e%2f, null bytes) and known LFI parameters reaching the Skyward theme directory; restricting wp-content/themes/skyward/ exposure at the web server level by denying direct PHP execution on non-template files (with the trade-off of potentially breaking legitimate AJAX endpoints); disabling PHP allow_url_include and tightening open_basedir to the WordPress root to limit which files can be included; and as a last resort, switching to a different theme until a fixed Skyward release is verified.