What is the CVSS score of EUVD-2025-210180?

EUVD-2025-210180 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Eros WordPress Theme are affected by EUVD-2025-210180?

ThemeREX Eros WordPress theme (versions 1.3 and earlier) has a HIGH-severity vulnerability (CVSS 8.1) allowing unauthenticated remote attackers to access sensitive files and potentially execute…

How to fix or mitigate EUVD-2025-210180?

Within 24 hours: Inventory all WordPress deployments for ThemeREX Eros theme; identify systems running version 1.3 or earlier and classify as critical. Within 7 days: Uninstall and remove the theme from all production WordPress sites; if business continuity requires theme functionality, implement WAF rules to block local file inclusion patterns (path traversal sequences, file:// and php:// protocol references). Within 30 days: Complete security review of WordPress theme and plugin inventory; establish continuous monitoring for component vulnerabilities and establish rapid patching processes.

Eros WordPress Theme EUVD-2025-210180

| CVE-2025-69167 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Eros

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable unauthenticated LFI (AV:N/PR:N/UI:N); AC:H reflects required non-default include precondition; C:H for arbitrary file read, I/A:L since RCE escalation is unconfirmed.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:49 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Eros <= 1.3 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the ThemeREX Eros WordPress theme versions 1.3 and earlier allows remote attackers to read arbitrary files and potentially achieve PHP code execution via include/require paths reachable without authentication. No public exploit identified at time of analysis, but the flaw is reported by Patchstack and tracked as EUVD-2025-210180. WordPress themes with LFI sinks are a recurring target because they expose include() statements through AJAX or template loader endpoints.

Technical ContextAI

Eros is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:eros). The root cause maps to CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), commonly called PHP file inclusion. In this class of bug, attacker-controlled input flows into a PHP include/require/include_once/require_once call without sufficient path normalization or allowlisting, letting the attacker traverse the filesystem (../) to load arbitrary local files. On WordPress, this typically surfaces through a theme handler, AJAX action, or template-loader parameter and can escalate from disclosure of wp-config.php to RCE if the attacker can include any controllable file (uploaded media, log files, session files, or wrappers like php://filter).

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/eros/vulnerability/wordpress-eros-theme-1-3-local-file-inclusion-vulnerability) does not cite a fixed Eros version. Until ThemeREX publishes a patched release above 1.3, deactivate and replace the Eros theme on production sites, or place a WAF/virtual-patch rule (Patchstack, Wordfence, or ModSecurity) in front of WordPress that blocks path-traversal sequences (../, %2e%2e, php://, file://, data://) and null bytes on theme and admin-ajax endpoints - with the trade-off that aggressive filtering can break legitimate plugins that use file path parameters. As compensating controls, set open_basedir and allow_url_include=Off in PHP, restrict read permissions on wp-config.php and uploads, and monitor web logs for requests containing traversal sequences targeting theme files; these reduce blast radius but do not eliminate the inclusion sink.