What is the CVSS score of EUVD-2025-210194?

EUVD-2025-210194 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Nexio WordPress Theme are affected by EUVD-2025-210194?

ThemeREX Nexio WordPress theme versions 1.10.0 and earlier contain an unauthenticated remote file inclusion flaw that allows attackers to access sensitive server files and potentially execute code…

How to fix or mitigate EUVD-2025-210194?

Within 24 hours: Inventory all WordPress installations using ThemeREX Nexio theme ≤ v1.10.0; escalate to business stakeholders; disable theme immediately on non-critical sites. Within 7 days: Remove ThemeREX Nexio entirely; deploy alternative theme; scan web server logs for LFI exploitation patterns; deploy WAF rules blocking PHP file inclusion attacks. Within 30 days: Complete security audit of all affected servers; establish WordPress patch management process; monitor vendor advisories for security updates to any replacement theme.

Nexio WordPress Theme EUVD-2025-210194

| CVE-2025-69113 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Nexio

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable PHP include sink (AV:N/PR:N/UI:N); AC:H reflects a non-trivial request precondition implied by the vendor; LFI on WordPress routinely yields full CIA impact via wp-config.php disclosure.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:03 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX Nexio WordPress theme (versions ≤ 1.10.0) allows remote attackers to coerce the PHP application into including arbitrary local files, enabling disclosure of sensitive server content and potentially remote code execution if attacker-controlled content can be staged on the host. The CWE-98 classification and PHP tag indicate a classic dynamic include/require sink reachable without authentication. At time of analysis there is no public exploit identified and no CISA KEV listing, but the unauthenticated network vector and high CVSS (8.1) warrant prompt action on any WordPress site running this theme.

Technical ContextAI

Nexio is a commercial WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:nexio). CWE-98 covers Improper Control of Filename for Include/Require Statement in PHP, the canonical PHP LFI/RFI sink: user-controllable input is concatenated into include(), require(), include_once(), or require_once() without proper allow-listing or path canonicalization. In a WordPress theme this commonly arises from AJAX handlers, template loaders, or shortcode parameters that map a request parameter to a filename. Because PHP include resolves relative paths against include_path and supports stream wrappers, such a sink can pull /etc/passwd, wp-config.php (exposing DB credentials and auth keys), or PHP session files; on hosts where attackers can plant content (uploads directory, log files, /tmp), it can pivot from disclosure to code execution.

RemediationAI

Patch available per vendor advisory - consult the Patchstack listing at https://patchstack.com/database/wordpress/theme/nexio/vulnerability/wordpress-nexio-theme-1-10-0-local-file-inclusion-vulnerability for the exact fixed release (an upgraded Nexio version beyond 1.10.0 is required; a specific fix version was not included in the supplied input, so verify via the advisory before deploying). Until the theme is updated, restrict access to the WordPress site behind authentication or a WAF rule that blocks suspicious include parameters containing '../', null bytes, 'php://', 'file://', or absolute paths (note this can break legitimate theme AJAX endpoints, so test in staging), harden PHP with open_basedir scoped to the WordPress docroot and allow_url_include=Off, and rotate WordPress salts and database credentials if you have reason to believe wp-config.php may already have been disclosed. As a last resort, switch to a different theme - deactivating Nexio alone may not be sufficient if the vulnerable PHP files remain reachable on disk.