Choreo Theme CVE-2025-69165

Target site must be running the ThemeREX Choreo WordPress theme at version 1.6 or earlier as the active theme, and the vulnerable Choreo endpoint (likely an AJAX/template-loader parameter accepting a file or template name) must be reachable over HTTP/HTTPS from the attacker. No WordPress authentication is required (PR:N). Exploitation is gated by the AC:H complexity factor - practical impact escalation from local file read to RCE additionally requires either PHP's allow_url_include=On for remote inclusion, or the presence of attacker-influenceable content in a known local path (log poisoning, session files, uploaded media). Pure file disclosure is achievable without those extras.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates a remote, unauthenticated path with high attack complexity and full CIA impact, producing the 8.1 score. The AC:H rating is noteworthy: NVD/Patchstack scoring usually applies it when exploitation depends on non-default conditions such as a specific page being rendered, a particular parameter being reachable, or PHP configuration like allow_url_include, which tempers the urgency relative to a clean AV:N/AC:L LFI. No EPSS score, KEV listing, SSVC decision, or published PoC was provided in the intelligence set, so real-world exploitation pressure cannot be quantified - treat this as a credible high-severity issue affecting any WordPress site running Choreo ≤ 1.6, but not yet evidenced as mass-exploited. The signal mix (high CVSS, no KEV/EPSS/PoC) is typical of freshly disclosed Patchstack theme vulnerabilities and warrants prompt patching without crisis-level response.

An unauthenticated attacker sends a crafted HTTP request to a public Choreo theme endpoint with a traversal payload in the vulnerable parameter (e.g., ?file=../../../../wp-config.php), causing the PHP include statement to read and render sensitive files such as wp-config.php, exposing database credentials and WordPress secret keys. With those credentials the attacker can reach the database directly or, if allow_url_include is enabled or a writable log/session file can be poisoned, pivot the LFI to full remote code execution under the web server account. No public exploit identified at time of analysis, but CWE-98 LFI flaws in WordPress themes are commonly weaponized within days of disclosure.