What is the CVSS score of EUVD-2025-210179?

EUVD-2025-210179 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Choreo Theme are affected by EUVD-2025-210179?

The Choreo WordPress theme through version 1.6 exposes a critical vulnerability allowing unauthenticated attackers to read arbitrary server files, risking exposure of database credentials,…

How to fix or mitigate EUVD-2025-210179?

Within 24 hours: Audit all WordPress installations to identify Choreo theme deployments; immediately deactivate the theme on all affected sites; activate WAF rules blocking LFI patterns (../, file://, etc.). Within 7 days: Analyze Apache/Nginx access logs and WordPress audit logs for evidence of exploitation; review sensitive files (wp-config.php, .env) for unauthorized access. Within 30 days: Migrate affected sites to alternative themes; establish monitoring of Patchstack advisories for vendor patch release; document timeline and disposition for compliance records.

Choreo Theme EUVD-2025-210179

| CVE-2025-69165 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Choreo

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Remote unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects dependence on reachable vulnerable param and PHP config for full RCE escalation; C:H direct file disclosure, I/A:L unless allow_url_include enabled.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:50 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Choreo <= 1.6 versions.

AnalysisAI

Local File Inclusion in the Choreo WordPress theme (versions through 1.6) allows unauthenticated remote attackers to include and read arbitrary local files from the server, with potential for further escalation to code execution depending on writable file content. The flaw was disclosed by Patchstack and is tracked as EUVD-2025-210179; no public exploit identified at time of analysis, and the CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability.

Technical ContextAI

Choreo is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:choreo). The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion'), meaning a user-controlled value reaches a PHP include/require statement without sufficient sanitization or allow-listing. In WordPress themes, this pattern commonly appears in AJAX handlers, shortcode renderers, or template-loader helpers that take a 'template', 'view', or 'file' parameter and pass it directly to include. Because PHP's include resolves paths relative to the executing script and honors traversal sequences, an attacker can pivot to arbitrary local files such as wp-config.php, /etc/passwd, or session files - and on installations where allow_url_include is enabled, escalate to remote inclusion and direct RCE.

RemediationAI

No vendor-released patch identified at time of analysis from the provided references; site owners should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/choreo/vulnerability/wordpress-choreo-theme-1-6-local-file-inclusion-vulnerability) and the ThemeREX/ThemeForest update channel for a Choreo release above 1.6 and upgrade as soon as it is published. In the interim, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that blocks traversal sequences (../, %2e%2e, php://, file://) on Choreo theme endpoints, set PHP allow_url_include=Off and open_basedir to the WordPress document root to neutralize remote-file-include escalation and restrict local reads, and consider temporarily switching to a different theme on internet-exposed sites if the workaround cannot be applied - accepting the trade-off of layout/design loss until a patched version ships.