What is the CVSS score of EUVD-2025-210186?

EUVD-2025-210186 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Learnify Theme are affected by EUVD-2025-210186?

The Learnify WordPress theme (versions ≤1.15.0) contains an unauthenticated file inclusion vulnerability (CVSS 8.1) that allows remote attackers to read arbitrary files from affected servers without…

How to fix or mitigate EUVD-2025-210186?

Within 24 hours: Inventory all WordPress installations using Learnify theme and document affected versions. Within 7 days: Deactivate and remove the Learnify theme from all WordPress instances; migrate to an alternative theme or core WordPress theme. Within 30 days: Apply web application firewall rules targeting LFI patterns (e.g., file inclusion parameters), restrict file access via web server configuration, and subscribe to Patchstack/WordPress security advisories for patch release notification.

Learnify Theme EUVD-2025-210186

| CVE-2025-60085 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Learnify

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Unauthenticated network LFI (AV:N/PR:N/UI:N); AC:H per Patchstack; primary impact is file disclosure (C:H), with I/A only realised via follow-on chaining not inherent to the flaw.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:07 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the Learnify WordPress theme (versions up to and including 1.15.0) allows remote attackers to read arbitrary files from the underlying server without credentials. Patchstack catalogued the issue as a PHP file inclusion flaw (CWE-98) and no public exploit was identified at time of analysis, though the WordPress theme ecosystem makes targeted scanning likely. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, tempered by high attack complexity.

Technical ContextAI

Learnify is a commercial WordPress theme produced by ThemeRex Group (CPE cpe:2.3:a:themerex_group:learnify) typically deployed for online-course / LMS sites. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion') indicates the theme passes attacker-influenced input into a PHP include/require construct without adequate validation or path canonicalisation, so traversal sequences or absolute paths reach the filesystem layer. In WordPress themes this pattern commonly appears in AJAX handlers, theme-option loaders, or template-switcher endpoints that resolve a 'page' or 'template' parameter against the theme directory.

RemediationAI

Patch status from the provided data is ambiguous: the Patchstack listing identifies ≤1.15.0 as vulnerable but no fixed version is enumerated in the intelligence supplied, so this should be recorded as 'No vendor-released patch identified at time of analysis' and confirmed against the Patchstack advisory at https://patchstack.com/database/wordpress/theme/learnify/vulnerability/wordpress-learnify-theme-1-15-0-local-file-inclusion-vulnerability before deployment. Until a fixed Learnify build is verified, compensating controls include placing a WAF rule (Patchstack mU+, Wordfence, or ModSecurity OWASP CRS) blocking traversal sequences (..%2f, %252e%252e) and absolute paths on theme AJAX/admin-ajax endpoints, restricting PHP open_basedir to the WordPress docroot to bound file read scope, and disabling the theme on staging/preview environments where it is not in active use. Each WAF rule risks false positives on legitimate file-management plugins, and open_basedir tightening can break plugins that read outside the docroot (e.g., backup or media-CDN integrations) - test before rolling to production.