What is the CVSS score of EUVD-2025-210175?

EUVD-2025-210175 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Printo WordPress Theme are affected by EUVD-2025-210175?

The Printo WordPress theme by ThemeRex (versions 1.11 and earlier) contains a vulnerability enabling remote file access without authentication, exposing sensitive server data and enabling potential…

How to fix or mitigate EUVD-2025-210175?

24 hours: Audit all WordPress installations using automated scanning (Wordfence, Sucuri, etc.) to identify Printo theme installations at versions ≤ 1.11. 7 days: Either migrate affected sites to an alternative theme or deactivate Printo entirely; apply compensating controls including WAF rules and PHP execution restrictions. 30 days: Maintain monitoring for vendor security advisory updates; document all remediation actions and track exploitation attempts in security logs.

Printo WordPress Theme EUVD-2025-210175

| CVE-2025-69159 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Printo

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Reachable over the web with no auth or user interaction (AV:N/PR:N/UI:N); AC:H reflects non-trivial parameter/encoding preconditions; LFI escalating to RCE yields C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:52 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Printo <= 1.11 versions.

AnalysisAI

Unauthenticated local file inclusion in the Printo WordPress theme (versions ≤ 1.11 by ThemeRex) allows remote attackers to include arbitrary local files via a PHP file-inclusion sink (CWE-98), enabling disclosure of sensitive server-side files and potential remote code execution if attacker-controlled content can be reached on disk. No public exploit identified at time of analysis, though Patchstack has cataloged the issue and the CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability.

Technical ContextAI

Printo is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:printo). CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program, also known as PHP Remote File Inclusion) indicates that a PHP include(), require(), include_once(), or require_once() statement consumes a user-controllable path without adequate validation or allow-listing. In WordPress themes, this typically appears in AJAX handlers (admin-ajax.php / admin-post.php with nopriv_ actions), template-loader shortcodes, or shortcode/loader endpoints that accept a template, view, or page parameter. Because the affected sink is reachable without authentication, the request can be issued by any anonymous HTTP client against the WordPress front-end.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/printo/vulnerability/wordpress-printo-theme-1-11-local-file-inclusion-vulnerability) does not list a fixed Printo release, so site owners should contact ThemeRex for an updated build or, if none is forthcoming, deactivate and replace the Printo theme. Compensating controls while waiting for a fix: deploy a WordPress WAF (Patchstack, Wordfence, or equivalent) with a virtual-patch rule for this CVE; block requests to the vulnerable theme endpoint at the reverse proxy (typically wp-content/themes/printo/* PHP files that are not normal template entry points, plus suspicious admin-ajax.php actions originating from the theme) - trade-off is that legitimate theme features invoking that endpoint will break; enforce open_basedir / disable_functions in php.ini to restrict which files PHP can include and to neutralize follow-on RCE primitives - trade-off is potential breakage of legitimate plugins; restrict outbound network egress from the web server to limit data exfiltration if file disclosure occurs.