Resurs WordPress Theme CVE-2025-69172

Target site must be running the ThemeREX Resurs WordPress theme version 1.3 or earlier as an active or otherwise reachable theme exposing the vulnerable include sink over HTTP(S). Exploitation requires the attacker to identify and reach the specific theme parameter that feeds an include/require call, and the CVSS AC:H rating implies non-trivial preconditions such as crafting a traversal payload, defeating path normalization, or relying on server-side state (log/session files) to escalate from disclosure to code execution. No authentication or user interaction is required (PR:N/UI:N). Sites that have deactivated or replaced the Resurs theme are not exploitable.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) indicates a network-reachable, unauthenticated flaw with HIGH attack complexity and complete CIA impact - consistent with an LFI requiring some non-trivial preconditions (e.g., specific parameter manipulation or path traversal encoding). No EPSS score, KEV listing, or POC is provided in the input, so real-world exploitation pressure cannot be confirmed. The AC:H rating tempers the otherwise critical-looking score: while LFI in a WordPress theme is a well-understood attacker target, exploitation likely depends on traversal mechanics or server-side conditions rather than a trivial one-shot request. Patchstack involvement suggests responsible disclosure rather than observed in-the-wild abuse, and KEV/POC status is UNKNOWN from the available data.

An unauthenticated attacker on the internet sends a crafted HTTP request to a vulnerable Resurs-theme endpoint, supplying a path parameter that traverses out of the theme directory to read wp-config.php and recover database credentials. With minor additional effort (e.g., log file poisoning or including a previously uploaded media file), the attacker escalates the LFI into PHP code execution under the web server account. No public exploit is identified at time of analysis, but the technique class is well documented for WordPress themes.