What is the CVSS score of CVE-2025-69176?

CVE-2025-69176 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of ITactics WordPress Theme are affected by CVE-2025-69176?

The ThemeREX ITactics WordPress theme (versions 1.0 and earlier) allows unauthenticated external attackers to access sensitive server files including database credentials and configuration data.

How to fix or mitigate CVE-2025-69176?

Within 24 hours: Identify all WordPress installations using ThemeREX ITactics theme; immediately disable or remove the theme if operationally feasible. Within 7 days: If removal is not possible, implement Web Application Firewall (WAF) rules to block exploitation attempts; restrict web server file permissions; review server logs for suspicious access patterns. Within 30 days: Migrate to an actively-maintained WordPress theme alternative; establish vendor communication to monitor for patch availability.

ITactics WordPress Theme CVE-2025-69176

EUVD-2025-210182 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Itactics

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Remote unauthenticated HTTP exploitation (AV:N/PR:N/UI:N); AC:H reflects the non-trivial payload crafting implied by the original vector; LFI primarily yields file disclosure (C:H), with I/A only realized via chaining (I:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:48 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.

AnalysisAI

Local File Inclusion in the ThemeREX ITactics WordPress theme versions 1.0 and earlier allows remote unauthenticated attackers to include arbitrary files from the underlying server, leading to disclosure of sensitive configuration data and potentially PHP code execution if attacker-controlled content can be staged on the host. Tracked by Patchstack and indexed in ENISA EUVD as EUVD-2025-210182, the issue carries a CVSS 8.1 (High) score with no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the ITactics commercial WordPress theme published by ThemeREX (CPE cpe:2.3:a:themerex:itactics). The root cause is classified as CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote/Local File Inclusion), meaning a user-controllable input is concatenated into a PHP include/require call without proper allow-listing or path normalization. Because WordPress themes execute within the PHP interpreter under the privileges of the web server, a successful include can read arbitrary readable files (wp-config.php, /etc/passwd, log files) and, if combined with a log-poisoning or upload primitive, can lead to PHP code execution.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory does not list a fixed version, so administrators should treat ITactics <= 1.0 as currently unpatched. The strongest mitigation is to deactivate and remove the ITactics theme and switch to a maintained theme, since an unmaintained theme with an unauthenticated LFI is unlikely to receive a timely fix. If removal is not feasible, deploy a WAF rule (Patchstack, Wordfence virtual patch, or ModSecurity) that blocks requests containing path traversal sequences (../, %2e%2e, php://, file://) and null-byte tricks targeting theme files under /wp-content/themes/itactics/, restrict file system permissions so the PHP process cannot read sensitive files such as wp-config.php where business-feasible, and monitor access logs for requests referencing theme PHP files with file path parameters - note that aggressive WAF rules may break legitimate template parameters and need tuning. Track Patchstack (https://patchstack.com/database/wordpress/theme/itactics/vulnerability/wordpress-itactics-theme-1-0-local-file-inclusion-vulnerability) for any future fix release.