What is the CVSS score of CVE-2025-69369?

CVE-2025-69369 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Racquet WordPress Theme are affected by CVE-2025-69369?

The Axiomthemes Racquet WordPress theme through version 1.12.0 contains a local file inclusion vulnerability enabling unauthenticated remote attackers to access sensitive files or achieve code…

How to fix or mitigate CVE-2025-69369?

Within 24 hours: inventory all WordPress installations using Axiomthemes Racquet theme and determine which versions are deployed. Within 7 days: deactivate and remove the vulnerable theme (all versions through 1.12.0); migrate to an alternative theme to restore normal functionality. Within 30 days: monitor Patchstack security advisories for Axiomthemes patch release; no vendor-released patch identified at time of analysis, so prioritize WAF rule deployment as interim protection.

Racquet WordPress Theme CVE-2025-69369

EUVD-2025-210041 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-02 audit@patchstack.com

GHSA-638h-7fhf-cjj2

LFI Information Disclosure PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 14:34 vuln.today

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion.

This issue affects Racquet: from n/a through 1.12.0.

AnalysisAI

Local File Inclusion in Axiomthemes Racquet WordPress theme (versions through 1.12.0) allows remote unauthenticated attackers to include arbitrary local PHP files via improperly validated filename input, leading to information disclosure and potential code execution. The flaw is classified as CWE-98 (PHP Remote File Inclusion) with a CVSS 8.1 (High) rating, though high attack complexity (AC:H) tempers its real-world exploitability. No public exploit identified at time of analysis, and the issue was reported through the Patchstack research program.

Technical ContextAI

The vulnerability resides in the Racquet WordPress theme distributed by Axiomthemes, a commercial theme vendor whose products are bundled with PHP include/require logic that constructs filenames from attacker-controlled input. CWE-98 (Improper Control of Filename for Include/Require Statement) refers to PHP's include/require/include_once/require_once family of functions being called with values that flow from user input without adequate sanitization or allow-listing - letting an attacker traverse the filesystem and execute or read arbitrary PHP files accessible to the web server process. Because WordPress themes execute within the same PHP context as core, an LFI in a theme effectively yields access to wp-config.php, log files, and any other file readable by the PHP user, and on misconfigured stacks can be chained with log poisoning or session files to achieve RCE.

RemediationAI

No vendor-released patch identified at time of analysis; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/racquet/vulnerability/wordpress-racquet-theme-1-12-0-local-file-inclusion-vulnerability for vendor updates and switch to a version newer than 1.12.0 once published by Axiomthemes. Until a fixed release is available, compensating controls include placing the site behind a WAF with rules blocking path traversal sequences (../, encoded variants) and suspicious file= or page= style parameters targeting the theme's PHP entrypoints, disabling allow_url_include and allow_url_fopen in php.ini to eliminate remote inclusion escalation (side effect: breaks legitimate plugins that fetch remote URLs via fopen), restricting filesystem access via open_basedir to the WordPress install directory (side effect: may break plugins that read /tmp or system paths), and as a last resort deactivating the Racquet theme in favor of an alternative.