What is the CVSS score of CVE-2025-69172?

CVE-2025-69172 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Resurs WordPress Theme are affected by CVE-2025-69172?

The ThemeREX Resurs WordPress theme (version 1.3 and below) contains an unauthenticated local file inclusion vulnerability permitting remote attackers to read sensitive files and potentially execute…

How to fix or mitigate CVE-2025-69172?

Within 24 hours: Audit all WordPress installations to identify those running ThemeREX Resurs theme version 1.3 or earlier. Within 7 days: Deploy Web Application Firewall (WAF) rules to block LFI attack patterns, or deactivate the theme if operationally feasible. Within 30 days: Upgrade to a patched version of ThemeREX Resurs (monitor vendor for release) or migrate to an alternative theme from verified vendor. Establish daily monitoring of vendor security advisories for patch availability.

Resurs WordPress Theme CVE-2025-69172

EUVD-2025-210235 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Resurs

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects traversal/encoding preconditions; full C/I/A impact since LFI can yield secrets and PHP code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:38 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the ThemeREX Resurs WordPress theme versions 1.3 and below allows remote attackers to include and execute arbitrary local files on the server. The flaw, tracked under CWE-98 (Improper Control of Filename for Include/Require), enables disclosure of sensitive files and potential code execution depending on server configuration. No public exploit identified at time of analysis, though Patchstack has confirmed the issue against the affected theme.

Technical ContextAI

The vulnerability is rooted in CWE-98, improper control of filename for an Include/Require statement in PHP. The Resurs theme by ThemeREX (CPE cpe:2.3:a:themerex:resurs) appears to pass user-controlled input into a PHP include/require call without sufficient sanitization or allowlisting. WordPress themes commonly expose AJAX endpoints or template loader parameters that, when improperly validated, can be coerced into loading attacker-chosen paths. Depending on PHP configuration (allow_url_include, open_basedir) and the inclusion sink, this can range from sensitive file disclosure (wp-config.php, /etc/passwd) to full PHP code execution via log poisoning, session files, or uploaded content.

RemediationAI

No vendor-released patch identified at time of analysis - the input data does not include a fixed Resurs theme version. Site operators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/resurs/vulnerability/wordpress-resurs-theme-1-3-local-file-inclusion-vulnerability) for an updated release and apply it once available. As compensating controls, deactivate and replace the Resurs theme on production sites (the most reliable mitigation, with the trade-off of frontend redesign), deploy a WAF rule blocking suspicious traversal sequences (../, %2e%2e, php://, file://) on requests targeting theme paths (may produce false positives on legitimate URL-encoded parameters), and harden PHP by setting allow_url_include=Off and configuring open_basedir to constrain accessible paths (may break legitimate plugins that read outside webroot). Restrict file system permissions on wp-config.php and other secrets so a successful read still limits credential exposure.