Line Agency
CVE-2025-69175
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running Line Agency ≤1.3.1
-
DeliveryCraft HTTP request with traversal or PHP wrapper payload
-
ExploitTrigger unsanitised include in theme handler
-
ExecutionRead wp-config.php and site secrets
-
PersistChain with log poisoning or php://filter for RCE
-
ImpactEstablish webshell and persistence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must have the Line Agency theme by ThemeRex installed and active at version 1.3.1 or earlier, with the vulnerable theme endpoint reachable over HTTP(S) from the attacker. Exploitation does not require authentication or user interaction (PR:N/UI:N), but the CVSS AC:H rating indicates a non-trivial request shape is needed - likely a specific parameter name and a path-traversal or PHP wrapper payload - and full I:H/A:H impact realistically depends on PHP being configured to permit include-to-RCE primitives (allow_url_include enabled or usable php://filter / data:// wrappers) or on chaining with log poisoning; on hardened PHP installs impact is bounded to local file disclosure. |
| Impact | The CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, unauthenticated issue with high impact across confidentiality, integrity and availability, tempered by AC:H which implies some non-trivial precondition (likely a specific request shape or wrapper). No EPSS score, KEV listing, SSVC decision or public POC is included in the provided intelligence, so real-world exploitation pressure cannot be quantified from this data alone. The I:H and A:H ratings are aggressive for a pure LFI and likely assume escalation to code execution via PHP wrappers or log poisoning; defenders should treat this as a high-priority WordPress theme issue but recognise that, in practice, impact may be limited to file disclosure unless the host PHP configuration enables include-to-RCE primitives. |
| Exploit ScenarioDerived | A remote unauthenticated attacker sends a crafted HTTP request to a vulnerable theme endpoint with a manipulated file or template parameter (for example using ../ traversal or a php://filter wrapper) to read wp-config.php and harvest the WordPress database credentials and AUTH_KEY values. With those secrets, or by chaining the LFI with log poisoning or a PHP wrapper, the attacker can pivot to full site takeover; no public POC is identified at time of analysis but Patchstack-class LFIs in WordPress themes are routinely weaponised within days of disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 17, 2026
Unauthenticated local file inclusion in the Line Agency WordPress theme versions 1.3.1 and earlier allows remote attackers to include and disclose arbitrary local files on the underlying server, potentially leading to sensitive data exposure and, depending on PHP configuration, remote code execution. The flaw is reported by Patchstack and is mapped to CWE-98 (PHP Remote File Inclusion), with no public exploit identified at time of analysis and no listing in the CISA KEV catalog.
RemediationAI
No vendor-released patch identified at time of analysis from the provided data; site owners should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/lineagency/vulnerability/wordpress-line-agency-theme-1-3-1-local-file-inclusion-vulnerability for a fixed version above 1.3.1 from ThemeRex and upgrade as soon as one is published. As compensating controls until a fix is available, deploy a WAF rule (Patchstack, Wordfence or ModSecurity) to block requests to the theme's vulnerable endpoint containing path-traversal sequences (../, %2e%2e, php://, file://, data://) or absolute paths, disable allow_url_include and allow_url_fopen in php.ini to neutralise remote-file-inclusion escalation, and restrict the web server's open_basedir to the WordPress install to limit which files an LFI can disclose; note that aggressive WAF rules can break legitimate AJAX template loading and open_basedir can cause plugin/theme breakage on shared hosts. If the theme is not business-critical, switch to an alternative theme until ThemeRex releases an update.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Line Agency is a commercial WordPress theme published by ThemeRex (CPE cpe:2.3:a:themerex:line_agency). The vulnerability falls under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of bug where user-controlled input reaches a PHP include(), require(), include_once() or require_once() call without proper sanitisation or allow-listing. In WordPress themes this typically manifests in template-loading or AJAX handlers that accept a file or template parameter via GET/POST and concatenate it into an include path, allowing path traversal to read arbitrary local files (e.g. wp-config.php) and, where allow_url_include or PHP wrappers like php://filter are usable, escalate to code execution.
Know when Line Agency gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects required wrapper/traversal payload; C:H for arbitrary file read, but I/A only Low since RCE depends on non-default PHP config.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
Executive ViewAI
Line Agency WordPress theme versions 1.3.1 and earlier contain a remote file inclusion vulnerability allowing unauthenticated attackers to access and disclose arbitrary files on affected servers, risking exposure of sensitive configuration data, database credentials, and application source code. Organizations running this theme face immediate risk of data breach and, depending on PHP configuration, potential server compromise. This vulnerability requires urgent remediation as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict PHP file inclusion via php.ini (allow_url_include=Off); (2) Deploy WAF to block path traversal patterns and suspicious include/require requests; (3) Enforce strict file permissions limiting web server access to necessary directories only; (4) Monitor web server logs for exploitation attempts (patterns: ../, encoded traversal, include/require functions); (5) If operationally viable, disable Line Agency theme or revert to known unaffected version until patch availability; (6) Consider implementing ModSecurity or equivalent WAF with OWASP CRS rules tailored for PHP LFI detection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB