What is the CVSS score of CVE-2025-69174?

CVE-2025-69174 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Etude WordPress Theme are affected by CVE-2025-69174?

Organizations using ThemeREX Etude WordPress theme v1.6 or earlier face direct risk of remote file disclosure and potential code execution through unauthenticated file inclusion attacks that require…

How to fix or mitigate CVE-2025-69174?

Within 24 hours: Inventory all WordPress installations using ThemeREX Etude theme v1.6 or earlier and immediately disable or remove the theme. Within 7 days: Deploy Web Application Firewall rules to block path traversal patterns (../, ..\ characters) and common LFI attempts; review access logs for exploitation indicators. Within 30 days: Replace theme with alternative from trusted provider; establish quarterly WordPress theme security audit process.

Etude WordPress Theme CVE-2025-69174

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Etude

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable theme endpoint with no auth (PR:N) but AC:H because attacker must know valid local paths; LFI primarily discloses files (C:H) with only limited integrity/availability impact unless chained to RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:39 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Etude <= 1.6 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Etude WordPress theme versions 1.6 and earlier allows remote attackers to coerce the application into including arbitrary PHP files, potentially leading to source disclosure, sensitive data exposure, and possible remote code execution depending on writable locations on the host. The high CVSS score of 8.1 reflects significant confidentiality, integrity, and availability impact, though the high attack complexity (AC:H) suggests non-trivial preconditions; no public exploit identified at time of analysis.

Technical ContextAI

The Etude theme is a commercial WordPress theme developed by ThemeREX, identified by CPE cpe:2.3:a:themerex:etude. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion') is the root cause class: PHP's include/require constructs accept attacker-influenced paths without proper validation or allowlist enforcement, letting an attacker traverse the filesystem or include unintended PHP files. In WordPress theme contexts, this typically occurs in AJAX handlers, template loaders, or shortcode processors that accept a 'file', 'template', or 'path' parameter from a request and pass it directly to a filesystem include call. Because the Patchstack tags label this as LFI (not RFI), the included file must already exist on the server, but local PHP files, log files, or uploaded media can still be leveraged.

RemediationAI

Upstream fix availability is not independently confirmed in the provided input; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/etude/vulnerability/wordpress-etude-theme-1-6-local-file-inclusion-vulnerability for the latest patched version and upgrade Etude to any release later than 1.6 as soon as ThemeREX publishes one. Until a patched theme version is installed, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing path-traversal sequences ('../', URL-encoded variants, php://, file://) targeting Etude theme endpoints, accepting the trade-off of possible false positives on legitimate template parameters. As a stronger compensating control, switch the active theme to a default WordPress theme (Twenty Twenty-Four) which removes the vulnerable code path entirely at the cost of losing site styling, or restrict access to /wp-content/themes/etude/ via webserver rules and disable allow_url_include/allow_url_fopen in php.ini to limit escalation pathways.