What is the CVSS score of CVE-2025-69178?

CVE-2025-69178 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Truemag WordPress Theme CVE-2025-69178

EUVD-2025-210184 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Truemag

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint, no auth (PR:N), AC:H reflects filter/encoding bypass implied by LFI in a maintained theme; LFI to wp-config disclosure plus log-poisoning RCE supports C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:47 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Truemag WordPress theme by Cactus Themes (versions up to and including 4.3.14.2) allows remote attackers to coerce the server into including arbitrary local PHP files without credentials. With CVSS 8.1 and full CIA impact (CWE-98), successful exploitation can lead to disclosure of sensitive files, configuration data, and potential code execution by including attacker-controlled or log-poisoned content, though no public exploit identified at time of analysis.

Technical ContextAI

Truemag is a commercial WordPress theme distributed by Cactus Themes (CPE cpe:2.3:a:cactusthemes:truemag) used for magazine/video-style sites. The flaw is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in a PHP Program), meaning a PHP include()/require() call within the theme dereferences a filename derived from user input without adequate path normalization or allowlisting. Because WordPress themes execute within the bootstrapped WP context, the included file inherits full application privileges and access to wp-config.php, session data, and database credentials, making LFI in a theme functionally equivalent to disclosure of the entire WordPress installation's secrets.

RemediationAI

No vendor-released patched version is identified in the provided data - the advisory cites only the affected range "<= 4.3.14.2" without a confirmed fix release, so administrators should monitor Cactus Themes (the vendor) for an update beyond 4.3.14.2 and consult https://patchstack.com/database/wordpress/theme/truemag/vulnerability/wordpress-truemag-theme-4-3-14-2-local-file-inclusion-vulnerability for the current status. Until a patched build is published, deactivate and remove the Truemag theme or switch to an alternative theme, since deactivation alone does not always prevent theme PHP files from being reached directly. As compensating controls, deploy a WordPress-aware WAF rule (Patchstack, Wordfence, or equivalent) to block path-traversal patterns and PHP wrapper schemes (php://, file://, data://, expect://) on theme endpoints, harden PHP with open_basedir restrictions scoped to the WordPress document root and disable allow_url_include, and ensure wp-config.php sits outside the webroot or has its filesystem permissions restricted - these mitigations reduce but do not eliminate exposure, since an attacker who can include logs or uploaded media may still escalate to code execution.