Tipsy WordPress Theme CVE-2025-69173

Target must be a WordPress site with the ThemeREX Tipsy theme version 1.1 or earlier installed and active so the vulnerable PHP entry point is registered and reachable. No authentication and no user interaction are required (PR:N/UI:N), and the attack is delivered over the network via HTTP(S) to the WordPress frontend. Exploitation is limited by CVSS attack complexity High, indicating the attacker must craft a specific path/filter-bypass payload rather than a trivial '?file=/etc/passwd' request, and by file system permissions of the PHP-FPM/Apache user which constrain which files can be disclosed. Impact escalation from disclosure to code execution further depends on the presence of an attacker-influencable file (uploads, log file with controlled User-Agent, session file) being includable by the vulnerable code path.

Signals are mixed and warrant a measured response. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High), with the High attack complexity suggesting non-trivial preconditions (e.g., specific path traversal sequence, server-side filter bypass, or null-byte/encoding trick) rather than a one-shot drop-in URL. PR:N confirms no authentication is required, which is the most defender-relevant signal here. EPSS and CISA KEV status are not provided in the input, and no public exploit identified at time of analysis, so this should be treated as a credible but not yet weaponized issue. The Patchstack tags (PHP, LFI, Information Disclosure) reinforce that the primary realistic impact is file disclosure; the CVSS I:H/A:H ratings imply potential for inclusion-to-RCE chains, but the description itself only states LFI, so the integrity/availability impact in real deployments depends on whether the included content is executed as PHP - verify against the Patchstack advisory before assuming RCE.

An unauthenticated remote attacker sends a crafted HTTP request to a vulnerable theme endpoint with a path parameter pointing to a sensitive file such as ../../../../wp-config.php, retrieving database credentials and WordPress secret keys. With those credentials the attacker authenticates directly to the database or pivots to admin takeover via cookie forgery using the stolen AUTH_KEY/SECURE_AUTH_KEY values. The High attack complexity in the CVSS vector implies the exact payload requires a specific traversal or filter-bypass sequence, but no user interaction is needed once the working request is identified.