What is the CVSS score of CVE-2025-69168?

CVE-2025-69168 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Spike WordPress Theme are affected by CVE-2025-69168?

The Spike WordPress theme (versions 1.2 and earlier) by ThemeREX contains a Local File Inclusion vulnerability enabling unauthenticated remote attackers to access sensitive server files,…

How to fix or mitigate CVE-2025-69168?

24 hours: Identify all WordPress installations using Spike theme ≤1.2 and document affected instances; restrict public access to WordPress admin if possible. 7 days: Disable the vulnerable Spike theme immediately and migrate to an alternative maintained theme, or deploy Web Application Firewall (WAF) rules blocking filename parameter exploitation (targeting wp-config.php, .env, and directory traversal patterns). 30 days: Monitor Patchstack and ThemeREX advisories for patch availability; establish formal response procedures for vulnerable third-party WordPress themes.

Spike WordPress Theme CVE-2025-69168

EUVD-2025-210181 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Spike

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable LFI in a WordPress theme (AV:N/PR:N/UI:N); AC:H reflects a non-trivial crafted payload; full C/I/A from arbitrary file inclusion enabling credential theft and potential code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:49 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Spike <= 1.2 versions.

AnalysisAI

Local File Inclusion in the Spike WordPress theme (versions ≤1.2) by ThemeREX allows remote unauthenticated attackers to coerce the PHP backend into including arbitrary local files via crafted filename parameters. Successful exploitation can disclose sensitive server-side files, configuration data, and credentials, and on misconfigured PHP installations may lead to code execution. No public exploit identified at time of analysis, but the issue is reported and tracked by Patchstack (WordPress vulnerability intelligence).

Technical ContextAI

The flaw is a CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), the canonical class for PHP Local/Remote File Inclusion. The affected component is the Spike commercial WordPress theme published by ThemeREX (CPE cpe:2.3:a:themerex:spike). In this class of bug a PHP include(), require(), or require_once() statement uses an attacker-controllable string - typically a query/POST parameter routed through an AJAX endpoint or template loader - without restricting it to a safe allowlist or sanitizing path traversal sequences. On a typical WordPress LAMP stack, this lets the attacker include arbitrary files readable by the www-data user (wp-config.php, /etc/passwd, log files), and in PHP installations where allow_url_include or stream wrappers are abused, may escalate to code execution.

RemediationAI

No vendor-released patch identified at time of analysis - the only reference is the Patchstack advisory (https://patchstack.com/database/wordpress/theme/spike/vulnerability/wordpress-spike-theme-1-2-local-file-inclusion-vulnerability), and no fixed Spike version is published in the supplied data; site owners should monitor ThemeREX for a release above 1.2 and upgrade as soon as it ships. Until a fix is available, deploy a WAF rule (Patchstack mU, Wordfence, or ModSecurity OWASP CRS rule 930100/930110) to block path traversal sequences (../, %2e%2e, php://, file://) and null-byte payloads against Spike theme endpoints, accepting that this can break legitimate template loading if rules are too broad. As a stronger compensating control, switch to a different theme or restrict the site behind HTTP basic auth or an IP allowlist while the theme is unpatched; harden PHP by setting open_basedir to the WordPress docroot and allow_url_include=Off in php.ini to limit the blast radius of any successful inclusion.