What is the CVSS score of CVE-2025-69166?

CVE-2025-69166 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Gunslinger Theme are affected by CVE-2025-69166?

The ThemeRex Gunslinger WordPress theme contains an unauthenticated local file inclusion vulnerability (CVE-2025-69166, CVSS 8.1) affecting all versions through 1.7, enabling any internet user to…

How to fix or mitigate CVE-2025-69166?

24 hours: Identify all WordPress instances running ThemeRex Gunslinger theme version 1.7 or earlier; immediately deactivate and remove the theme from all affected sites. 7 days: For installations where immediate theme removal is not operationally feasible, deploy Web Application Firewall rules blocking path traversal patterns and restrict file system permissions on sensitive directories (/etc/, wp-config.php, backup locations). 30 days: Complete migration to alternative themes; monitor vendor security advisories and execute immediate patching upon ThemeRex Gunslinger patch release.

Gunslinger Theme CVE-2025-69166

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Gunslinger

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects needing the specific vulnerable parameter; high confidentiality via file disclosure, lower I/A absent confirmed RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:40 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Gunslinger WordPress theme through version 1.7 allows remote attackers to coerce PHP into including arbitrary files from the server filesystem, leading to disclosure of sensitive files and potential remote code execution where attacker-influenced content can be staged. No public exploit identified at time of analysis, but the flaw is reachable without authentication and affects all installations running version 1.7 or earlier of the theme.

Technical ContextAI

Gunslinger is a commercial WordPress theme published by ThemeRex (CPE cpe:2.3:a:themerex:gunslinger). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, aka PHP Remote File Inclusion), where a PHP include/require statement consumes a request-controlled path without proper validation or allowlisting. In WordPress themes this pattern typically appears in template loader endpoints, AJAX handlers, or framework files that route a parameter to include(), enabling traversal to local PHP files and, depending on PHP configuration (allow_url_include, log poisoning, session/upload file primitives), escalation to code execution.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/gunslinger/vulnerability/wordpress-gunslinger-theme-1-7-local-file-inclusion-vulnerability) for the latest fixed-version information and upgrade Gunslinger beyond 1.7 once an update is published by ThemeRex. Until a patched release is confirmed, deactivate and replace the Gunslinger theme on production sites (acknowledging this changes the front-end appearance), or place the site behind a WAF such as Patchstack/Wordfence with virtual patching enabled and block requests containing path traversal sequences and PHP wrapper schemes (../, ..\, php://, file://, data://, expect://, zip://) targeting theme endpoints. Harden PHP by setting allow_url_include=Off and open_basedir to restrict the filesystem visible to the web user (trade-off: may break legitimate plugins that read outside the WordPress root), and restrict direct access to theme PHP files via .htaccess/nginx rules where possible.