Gunslinger Theme CVE-2025-69166

The target WordPress site must have the ThemeRex Gunslinger theme installed and active (or at minimum have its PHP entry points reachable via wp-content/themes/gunslinger/) at version 1.7 or earlier; no WordPress user account is required (PR:N) and no victim interaction is needed (UI:N). Exploitation is limited by AC:H, which indicates an attacker-side prerequisite beyond a trivial single request - likely knowledge of the specific vulnerable parameter/endpoint and a server PHP configuration that permits the include path (e.g., absence of open_basedir restrictions); sites running WAFs like Patchstack/Wordfence with LFI rules, or with the theme disabled or replaced, are not exploitable.

The signals are mixed. CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) - unauthenticated and network-reachable with high impact across CIA, but with AC:H indicating some attacker-side condition beyond a trivial request. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided in the input. SSVC fields were not supplied. Realistically, WordPress LFI bugs in themes are routinely automated against exposed sites once a Patchstack advisory exists, so AC:H should not be read as 'safe'; the practical priority is high for any site still running Gunslinger <= 1.7, even though widespread mass-exploitation telemetry is not yet evident. Key data limitation: the Patchstack reference is the sole source, and the exact vulnerable parameter, fix version, and patch status are not disclosed in the provided input.

An attacker discovers a WordPress site running the Gunslinger theme via fingerprinting (wp-content/themes/gunslinger/ paths or HTML signatures) and issues a crafted HTTP request to a vulnerable theme endpoint with a filename parameter pointing to a local file such as wp-config.php or /etc/passwd. The PHP include resolves the traversal path and returns or executes the file contents, exposing database credentials and WordPress secret keys; with allow_url_include or log/session poisoning available, the attacker chains the disclosure into arbitrary PHP execution under the web user. No public exploit identified at time of analysis, but the bug class is straightforward to weaponize once the vulnerable parameter is identified from the Patchstack advisory.