Spike WordPress Theme CVE-2025-69168

The vulnerable site must be running the ThemeREX Spike WordPress theme at version 1.2 or earlier and expose the theme's vulnerable PHP entry point over HTTP/HTTPS to the attacker - no WordPress login, user role, or victim interaction is required (PR:N/UI:N). Limiting factors flagged by AC:H in the CVSS vector suggest the attacker must craft a specific request - likely a particular parameter name, an encoded path-traversal payload that bypasses partial sanitization, or knowledge of an internal file path - rather than a trivially fuzzable input; the description does not name the exact endpoint, so the precise pre-request enumeration step is inferred and should be confirmed against the Patchstack advisory.

The CVSS 3.1 score of 8.1 is driven by AV:N/PR:N/UI:N (reachable over the network without authentication or user interaction) combined with full C/I/A impact, tempered by AC:H - the analyst at Patchstack judged some non-trivial precondition (likely a specific request shape or hard-to-guess parameter). Real-world risk should be treated as elevated because WordPress themes are mass-deployed and routinely crawled by automated LFI scanners, and Patchstack-reported theme issues historically attract opportunistic exploitation within weeks of disclosure. No EPSS, KEV, or SSVC data is supplied in the input, and no public PoC is referenced, so prioritization rests on CVSS plus deployment exposure. The AC:H tag means this is unlikely to be a one-shot wormable bug, but unauthenticated LFI in a WordPress theme is a credible breach vector and should not be deprioritized on AC:H alone.

An attacker scans WordPress sites fingerprinted as running the Spike theme, then sends a crafted unauthenticated HTTP request to a vulnerable theme endpoint with a path-traversal payload in the file/template parameter, causing PHP to include /var/www/html/wp-config.php and return database credentials and the WordPress AUTH_KEYs in the response. With those credentials the attacker pivots to the database, creates an administrator user, and installs a malicious plugin for persistent code execution. No public PoC is referenced, so the initial exploit must be developed from the advisory and source review.