What is the CVSS score of CVE-2025-69175?

CVE-2025-69175 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Line Agency are affected by CVE-2025-69175?

Line Agency WordPress theme versions 1.3.1 and earlier contain a remote file inclusion vulnerability allowing unauthenticated attackers to access and disclose arbitrary files on affected servers,…

How to fix or mitigate CVE-2025-69175?

Within 24 hours: Identify and inventory all WordPress installations running Line Agency theme versions 1.3.1 and earlier; prioritize systems handling sensitive data. Within 7 days: Deploy Web Application Firewall (WAF) rules to block directory traversal patterns (../, encoded variants); implement PHP hardening (allow_url_include=Off, allow_url_fopen=Off in php.ini); evaluate feasibility of reverting to theme version 1.3.2 or later if released, or switching to alternative themes. Within 30 days: Monitor Patchstack advisory channel for patch release; plan complete migration to alternative actively-maintained themes with documented security practices; conduct audit for any data exposure during vulnerability window.

Line Agency CVE-2025-69175

HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Line Agency

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects required wrapper/traversal payload; C:H for arbitrary file read, but I/A only Low since RCE depends on non-default PHP config.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:39 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.

AnalysisAI

Unauthenticated local file inclusion in the Line Agency WordPress theme versions 1.3.1 and earlier allows remote attackers to include and disclose arbitrary local files on the underlying server, potentially leading to sensitive data exposure and, depending on PHP configuration, remote code execution. The flaw is reported by Patchstack and is mapped to CWE-98 (PHP Remote File Inclusion), with no public exploit identified at time of analysis and no listing in the CISA KEV catalog.

Technical ContextAI

Line Agency is a commercial WordPress theme published by ThemeRex (CPE cpe:2.3:a:themerex:line_agency). The vulnerability falls under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of bug where user-controlled input reaches a PHP include(), require(), include_once() or require_once() call without proper sanitisation or allow-listing. In WordPress themes this typically manifests in template-loading or AJAX handlers that accept a file or template parameter via GET/POST and concatenate it into an include path, allowing path traversal to read arbitrary local files (e.g. wp-config.php) and, where allow_url_include or PHP wrappers like php://filter are usable, escalate to code execution.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; site owners should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/lineagency/vulnerability/wordpress-line-agency-theme-1-3-1-local-file-inclusion-vulnerability for a fixed version above 1.3.1 from ThemeRex and upgrade as soon as one is published. As compensating controls until a fix is available, deploy a WAF rule (Patchstack, Wordfence or ModSecurity) to block requests to the theme's vulnerable endpoint containing path-traversal sequences (../, %2e%2e, php://, file://, data://) or absolute paths, disable allow_url_include and allow_url_fopen in php.ini to neutralise remote-file-inclusion escalation, and restrict the web server's open_basedir to the WordPress install to limit which files an LFI can disclose; note that aggressive WAF rules can break legitimate AJAX template loading and open_basedir can cause plugin/theme breakage on shared hosts. If the theme is not business-critical, switch to an alternative theme until ThemeRex releases an update.