Eventicity WordPress Theme
CVE-2025-69170
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Eventicity ≤1.5
-
DeliveryCraft path-traversal LFI request to theme endpoint
-
ExploitPHP include() loads attacker-chosen local file
-
ExecutionExfiltrate wp-config.php database credentials and salts
-
PersistReuse credentials or forge auth cookies
-
ImpactAchieve administrative access or RCE on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable Eventicity WordPress theme (ThemeRex, versions ≤ 1.5) must be installed and active on a publicly reachable WordPress site, and the specific vulnerable theme endpoint/parameter must be accessible without authentication (consistent with PR:N). Limiting factors per the CVSS vector: AC:H indicates the attacker must construct a non-trivial request (likely a specific path-traversal payload, encoding, or chained parameter) rather than a one-shot URL, and effective impact depends on the PHP process's filesystem permissions and on whether the PHP configuration permits remote-URL inclusion (allow_url_include) for the more severe RFI variant implied by CWE-98. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L missing - actually AC:H/PR:N/UI:N/C:H/I:H/A:H, score 8.1) signals a high-impact, unauthenticated network-reachable flaw whose only friction is elevated attack complexity, likely reflecting the need for a specific request shape or path traversal payload. KEV status is not asserted and no POC is referenced, so this is not yet a confirmed mass-exploitation event; however, WordPress themes are commonly scanned at scale by automated kits, so risk of opportunistic exploitation rises sharply once a working payload becomes public. EPSS is not provided in the input - treat the score as unknown rather than low. Note that the CWE classifies this as PHP RFI/LFI while the title says strictly LFI; without seeing the sink it is unclear whether remote URL inclusion is also possible, which would materially raise impact. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable Eventicity theme endpoint with a manipulated file or path parameter (for example a traversal sequence pointing at wp-config.php), causing PHP to include the target file and disclose database credentials and authentication keys. The attacker then uses those credentials against the exposed MySQL service or pivots to webshell upload via the wp-admin REST/upload paths; no public POC is referenced, but the unauthenticated network vector makes this a plausible opportunistic target once a payload is reverse-engineered from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Local File Inclusion in the ThemeRex Eventicity WordPress theme versions 1.5 and earlier allows remote unauthenticated attackers to include and execute arbitrary local files on the server. The flaw is reported by Patchstack and tagged as PHP information disclosure; no public exploit identified at time of analysis, though the unauthenticated network vector makes this a meaningful priority for affected WordPress sites. Successful exploitation can expose sensitive files such as wp-config.php and may enable code execution depending on what files can be reached.
RemediationAI
No vendor-released patched version is identified in the available data - upgrade to any Eventicity release newer than 1.5 once ThemeRex publishes a fix, and monitor the Patchstack advisory at https://patchstack.com/database/wordpress/theme/eventicity/vulnerability/wordpress-eventicity-theme-1-5-local-file-inclusion-vulnerability for the fixed build. Until a patched theme is available, deactivate and replace the Eventicity theme on production sites, or place a WAF rule (Patchstack, Wordfence, or equivalent) in front of WordPress that blocks path-traversal sequences (../, encoded variants, null bytes) and known LFI parameter names targeting theme endpoints - note this can break legitimate theme AJAX calls and should be tested in staging. As compensating controls, set PHP allow_url_include=Off and allow_url_fopen=Off to neutralize any remote-inclusion variant, restrict the web user's filesystem read scope via open_basedir to the WordPress docroot (be aware this can break plugins that read outside it), and rotate any secrets in wp-config.php that may already have been exposed.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Eventicity is a commercial WordPress theme by ThemeRex (CPE cpe:2.3:a:themerex:eventicity) intended for event-oriented sites. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP - PHP Remote File Inclusion), meaning a user-controlled value reaches a PHP include/require statement without proper sanitization or allowlisting. In WordPress themes this typically manifests through an AJAX action, a template loader, or a query parameter passed into include()/require() that traverses or substitutes paths, enabling inclusion of arbitrary files reachable by the PHP process.
Know when Eventicity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable WordPress theme endpoint with no auth (AV:N/PR:N/UI:N); AC:H reflects crafted traversal payload; LFI primarily discloses files (C:H) with secondary I/A impact only via follow-on credential reuse.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
Executive ViewAI
ThemeRex Eventicity WordPress theme versions 1.5 and earlier contain an unauthenticated Local File Inclusion vulnerability (CVSS 8.1) allowing remote attackers to read and execute arbitrary files on affected servers. Organizations using this theme face immediate risk of credential exposure (database passwords in wp-config.php) and potential full site compromise; no vendor patch currently exists.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate and remove ThemeRex Eventicity theme from all WordPress installations; (2) Implement Web Application Firewall rules to block requests containing path traversal sequences and file:// protocol references; (3) Restrict filesystem permissions on wp-config.php and wp-settings.php to read-only by the web server user only; (4) Deploy file integrity monitoring on WordPress configuration directories; (5) Maintain offline backups of database credentials and configuration secrets outside web-accessible storage.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB