Etude WordPress Theme CVE-2025-69174

Requires a WordPress installation with the ThemeREX Etude theme version 1.6 or earlier active and the vulnerable theme endpoint (likely an AJAX handler, template loader, or shortcode processor accepting a file/path parameter) network-reachable by the attacker - no authentication and no user interaction are required per PR:N/UI:N. Exploitation is limited by AC:H, meaning the attacker must know or discover a valid local filesystem path to include and may need to satisfy parsing constraints (e.g., null-byte handling, suffix appending) imposed by the theme's include logic; full RCE escalation additionally depends on the presence of an includable PHP-tainted file such as a poisoned log, uploaded media with embedded PHP, or a session file under attacker control.

The CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1, driven by full CIA impact and no authentication or user interaction needed; however, AC:H signals that specific conditions or attacker effort (e.g., knowledge of a valid file path or race condition) are required, lowering opportunistic exploitation likelihood. No EPSS score, KEV listing, or public POC was provided in the input, so this is not currently confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis. Practically, WordPress LFI flaws frequently get folded into automated scanning kits once a vulnerability detail page is indexed, so the risk profile is realistically 'medium-to-high latent risk' rather than imminent mass exploitation - but any internet-exposed WordPress site running the Etude theme should treat it as priority remediation because LFI in PHP commonly escalates to RCE via log poisoning or session file inclusion. Key data gaps: exact vulnerable endpoint/parameter, fix version, and Patchstack advisory specifics are not in the input.

A remote unauthenticated attacker sends a crafted HTTP request to a vulnerable Etude theme endpoint with a manipulated file/path parameter pointing to a local PHP file (e.g., wp-config.php for credential disclosure, or an uploaded image containing PHP payload, or /var/log/apache2/access.log poisoned via a prior request with PHP in the User-Agent). The include statement executes the chosen file in PHP context, allowing the attacker to read sensitive configuration or, by combining with log/upload poisoning, achieve remote code execution as the webserver user. No public exploit identified at time of analysis, but PHP LFI exploitation techniques are well-documented and easily adapted once the vulnerable parameter is identified.