What is the CVSS score of CVE-2025-69170?

CVE-2025-69170 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Eventicity WordPress Theme are affected by CVE-2025-69170?

ThemeRex Eventicity WordPress theme versions 1.5 and earlier contain an unauthenticated Local File Inclusion vulnerability (CVSS 8.1) allowing remote attackers to read and execute arbitrary files on…

How to fix or mitigate CVE-2025-69170?

24 hours: Inventory all WordPress installations using ThemeRex Eventicity theme (versions 1.5 and below) and immediately disable the theme on affected sites or restrict web server access to /wp-content/themes/eventicity/. 7 days: Migrate to an alternative, actively maintained WordPress theme or implement WAF rules blocking path traversal payloads (../, file://, etc.). 30 days: Subscribe to Patchstack and ThemeRex security advisories; apply version 1.6 or later immediately upon vendor release.

Eventicity WordPress Theme CVE-2025-69170

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Eventicity

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable WordPress theme endpoint with no auth (AV:N/PR:N/UI:N); AC:H reflects crafted traversal payload; LFI primarily discloses files (C:H) with secondary I/A impact only via follow-on credential reuse.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:40 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.

AnalysisAI

Local File Inclusion in the ThemeRex Eventicity WordPress theme versions 1.5 and earlier allows remote unauthenticated attackers to include and execute arbitrary local files on the server. The flaw is reported by Patchstack and tagged as PHP information disclosure; no public exploit identified at time of analysis, though the unauthenticated network vector makes this a meaningful priority for affected WordPress sites. Successful exploitation can expose sensitive files such as wp-config.php and may enable code execution depending on what files can be reached.

Technical ContextAI

Eventicity is a commercial WordPress theme by ThemeRex (CPE cpe:2.3:a:themerex:eventicity) intended for event-oriented sites. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP - PHP Remote File Inclusion), meaning a user-controlled value reaches a PHP include/require statement without proper sanitization or allowlisting. In WordPress themes this typically manifests through an AJAX action, a template loader, or a query parameter passed into include()/require() that traverses or substitutes paths, enabling inclusion of arbitrary files reachable by the PHP process.

RemediationAI

No vendor-released patched version is identified in the available data - upgrade to any Eventicity release newer than 1.5 once ThemeRex publishes a fix, and monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/eventicity/vulnerability/wordpress-eventicity-theme-1-5-local-file-inclusion-vulnerability for the fixed build. Until a patched theme is available, deactivate and replace the Eventicity theme on production sites, or place a WAF rule (Patchstack, Wordfence, or equivalent) in front of WordPress that blocks path-traversal sequences (../, encoded variants, null bytes) and known LFI parameter names targeting theme endpoints - note this can break legitimate theme AJAX calls and should be tested in staging. As compensating controls, set PHP allow_url_include=Off and allow_url_fopen=Off to neutralize any remote-inclusion variant, restrict the web user's filesystem read scope via open_basedir to the WordPress docroot (be aware this can break plugins that read outside it), and rotate any secrets in wp-config.php that may already have been exposed.