ITactics WordPress Theme CVE-2025-69176

Exploitation requires that the target WordPress site has the ThemeREX ITactics theme installed and active at version 1.0 or earlier, and that the vulnerable theme PHP endpoint (which performs an include/require on attacker-controlled input) is reachable over HTTP/HTTPS without authentication. Limiting factors: CVSS AC:H indicates the attacker must construct a specific request that satisfies non-trivial conditions (likely a particular parameter, path traversal encoding, or pre-existing file path), the PHP open_basedir or allow_url_include directives on hardened hosts may constrain which files can be included, and full RCE typically requires a secondary primitive (log poisoning, session file write, or uploaded attachment) since CWE-98 alone yields file disclosure on most modern PHP configurations.

Signals are mixed and partially incomplete. CVSS 3.1 rates this 8.1 High with network vector, no privileges and no user interaction (AV:N/PR:N/UI:N) and full CIA impact, which on paper is a serious unauthenticated remote bug; however AC:H indicates the attacker must satisfy non-trivial conditions (likely a specific request shape or path traversal sequence). The vulnerability is not listed in CISA KEV, EPSS data was not supplied, and no public exploit identified at time of analysis, so this is currently a latent risk rather than evidence of mass exploitation. WordPress themes are routinely scanned by opportunistic actors once Patchstack publishes details, so realistic risk is moderate-to-high for any site still running ITactics <= 1.0 even though active exploitation has not been confirmed.

An opportunistic attacker fingerprints WordPress sites running the ITactics theme via theme path enumeration, then sends a crafted HTTP request to a vulnerable theme endpoint with a path-traversal or PHP wrapper payload in the include parameter to read wp-config.php and exfiltrate the database credentials and AUTH_KEY secrets. With those secrets the attacker forges admin sessions or pivots into the database, and if a log/upload primitive is reachable they can chain it into PHP code execution under the web server account.