What is the CVSS score of CVE-2025-69173?

CVE-2025-69173 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tipsy WordPress Theme are affected by CVE-2025-69173?

The ThemeREX Tipsy WordPress theme (versions 1.1 and earlier) contains a high-severity vulnerability allowing remote, unauthenticated attackers to access sensitive database credentials and…

How to fix or mitigate CVE-2025-69173?

Within 24 hours: Identify all WordPress installations using ThemeREX Tipsy theme version 1.1 or earlier; deactivate the vulnerable theme immediately; review web server logs for suspicious file access patterns. Within 7 days: Rotate WordPress database credentials (assume potential compromise); migrate affected sites to an alternative actively-maintained WordPress theme; analyze logs for evidence of successful exploitation. Within 30 days: Complete removal of the vulnerable theme across all installations; deploy Web Application Firewall (WAF) rules blocking file inclusion and path traversal attempts; establish continuous monitoring for related attack patterns.

Tipsy WordPress Theme CVE-2025-69173

EUVD-2025-210236 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Tipsy

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable WordPress endpoint with no auth (AV:N/PR:N/UI:N); AC:H reflects required filter/traversal bypass; LFI primarily discloses files (C:H), with limited I/A impact unless inclusion-to-RCE is demonstrated.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:37 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Tipsy WordPress theme versions 1.1 and earlier allows remote attackers to coerce the PHP interpreter into including arbitrary files via attacker-controlled path parameters. Successful exploitation can disclose sensitive server-side files, leak configuration secrets such as wp-config.php database credentials, and - depending on environment - escalate to code execution by including log files, session files, or other writable artifacts. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Tipsy is a commercial WordPress theme distributed by ThemeREX (cpe:2.3:a:themerex:tipsy). The flaw is classified as CWE-98, Improper Control of Filename for Include/Require Statement in a PHP Program, which covers PHP file inclusion bugs where user input flows into include/require/include_once/require_once without adequate path normalization or allow-listing. In WordPress themes this pattern typically appears in template loader logic, AJAX handlers exposed through admin-ajax.php, or shortcode handlers that accept a 'file', 'view', or 'template' parameter. Because the issue is reachable pre-authentication, the vulnerable entry point is exposed on any WordPress site running the theme regardless of user role configuration.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data - the Patchstack reference documents versions <= 1.1 as vulnerable without listing a fixed release, so consult https://patchstack.com/database/wordpress/theme/tipsy/vulnerability/wordpress-tipsy-theme-1-1-local-file-inclusion-vulnerability and the ThemeREX vendor site for the latest fixed build before upgrading. Until a confirmed patched version is available, the most effective compensating control is to deactivate and remove the Tipsy theme and switch to an alternative theme (trade-off: visual/functional change to the site). If deactivation is not acceptable, place a WAF rule (Patchstack, Wordfence, Cloudflare managed rules) blocking path traversal patterns (../, %2e%2e, null bytes, php://, file://) on requests targeting theme files and admin-ajax.php actions registered by the theme (trade-off: rule may be bypassed by novel encodings and adds latency). Additionally restrict PHP open_basedir to the WordPress webroot and disable allow_url_include to limit the blast radius of any inclusion (trade-off: may break plugins that rely on broad filesystem access).