What is the CVSS score of EUVD-2025-210195?

EUVD-2025-210195 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of MaxiNet WordPress Theme are affected by EUVD-2025-210195?

ThemeREX MaxiNet WordPress theme through v1.2.10 contains an unauthenticated local file inclusion flaw that exposes sensitive server files, including wp-config.php, to attackers seeking database…

How to fix or mitigate EUVD-2025-210195?

Within 24 hours: Inventory all WordPress installations running ThemeREX MaxiNet theme through version 1.2.10; disable the theme on production systems or restrict administrative access to authenticated users only. Within 7 days: Deploy Web Application Firewall rules blocking local file inclusion patterns (directory traversal sequences) in theme parameters; immediately rotate all database passwords, WordPress security keys (AUTH_KEY, SECURE_AUTH_KEY, etc.), and API credentials stored in wp-config.php; audit historical access logs for exploitation attempts using patterns like '../../../../'. Within 30 days: Monitor ThemeREX official channels and Patchstack for security update availability; apply vendor patch immediately upon release, or migrate affected WordPress instances to an alternative maintained theme if patch timeline remains unclear.

MaxiNet WordPress Theme EUVD-2025-210195

| CVE-2025-69114 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Maxinet

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Network-reachable and unauthenticated (AV:N/PR:N); AC:H reflects the non-default precondition implied by the original vector; primary impact is file disclosure (C:H) with only secondary integrity/availability via include chaining (I:L/A:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:02 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeREX MaxiNet WordPress theme through version 1.2.10 allows remote attackers to coerce the PHP application into including arbitrary local files, exposing sensitive configuration data such as wp-config.php and potentially enabling code execution if log poisoning or uploaded content can be reached. The flaw was disclosed via Patchstack and tracked as EUVD-2025-210195; no public exploit identified at time of analysis, and no CISA KEV listing exists.

Technical ContextAI

MaxiNet is a commercial WordPress theme published by ThemeREX (CPE cpe:2.3:a:themerex:maxinet). The weakness maps to CWE-98 (Improper Control of Filename for Include/Require Statement in PHP, aka 'PHP Remote File Inclusion'), which occurs when user-controllable input is passed into PHP include/require constructs without sanitization or allow-listing. In WordPress themes this typically manifests in template-loading helpers, AJAX endpoints, or shortcode handlers that accept a 'file', 'template', 'page', or similar parameter and concatenate it into an include path, allowing path traversal (../) or absolute-path references to read or execute server-side files within PHP's open_basedir scope.

RemediationAI

No vendor-released patch identified at time of analysis; site owners should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/maxinet/vulnerability/wordpress-maxinet-theme-1-2-10-local-file-inclusion-vulnerability and the ThemeREX changelog for any version newer than 1.2.10 and upgrade as soon as one is published. As compensating controls until a patched release is available, deploy a WAF rule (Patchstack/Wordfence virtual patch) to block path-traversal sequences and absolute paths in query parameters reaching the theme's PHP endpoints, restrict PHP open_basedir to the WordPress installation directory to limit which files can be included, disable execution of PHP in wp-content/uploads to blunt log-poisoning escalation, and as a last resort switch the active theme away from MaxiNet - each control has trade-offs: WAF rules can be bypassed with encoding tricks, open_basedir can break plugins that legitimately read shared paths, and disabling PHP in uploads can break image-processing plugins.