What is the CVSS score of EUVD-2025-210199?

EUVD-2025-210199 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Deliciosa WordPress Theme are affected by EUVD-2025-210199?

ThemeRex Deliciosa WordPress theme versions 1.10.0 and earlier are vulnerable to remote file inclusion attacks without authentication, exposing sensitive server files and enabling code execution on…

How to fix or mitigate EUVD-2025-210199?

Within 24 hours: Audit all WordPress installations to identify those running ThemeRex Deliciosa version 1.10.0 or earlier. Within 7 days: Disable the vulnerable theme and deploy an alternative, or implement Web Application Firewall (WAF) rules blocking path traversal patterns to the theme directory if removal is infeasible. Within 30 days: Monitor Patchstack advisory EUVD-2025-210199 for patch release; apply immediately upon availability and redeploy only after validating the fix.

Deliciosa WordPress Theme EUVD-2025-210199

| CVE-2025-69121 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-16 Patchstack

PHP Information Disclosure LFI Deliciosa

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint, unauthenticated (PR:N), but AC:H reflects required payload crafting; LFI can disclose secrets and chain to RCE, justifying C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:00 vuln.today

CVE Published

Jun 16, 2026 - 20:57 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Local File Inclusion in Deliciosa <= 1.10.0 versions.

AnalysisAI

Unauthenticated local file inclusion in the ThemeRex Deliciosa WordPress theme (versions up to and including 1.10.0) allows remote attackers to coerce the PHP application into including arbitrary local files, potentially leading to sensitive file disclosure and code execution. The flaw is reachable without authentication but carries high attack complexity per the CVSS vector, and no public exploit identified at time of analysis. Patchstack disclosed the issue and tracks it as EUVD-2025-210199.

Technical ContextAI

Deliciosa is a commercial WordPress theme distributed by ThemeRex (CPE cpe:2.3:a:themerex:deliciosa). The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), meaning a PHP include/require statement consumes attacker-influenced input - typically a request parameter - without adequately normalizing or restricting the resolved path. In a WordPress theme context, this is commonly a router/template-loader endpoint reachable through the front-end (e.g., a theme AJAX action, shortcode handler, or page template selector) that passes user-supplied values into include/require, allowing path traversal to other files on the local filesystem and inclusion of attacker-controlled content if log/upload poisoning or PHP wrappers are reachable.

RemediationAI

No vendor-released patch identified at time of analysis - the input data references the Patchstack advisory but does not cite a fixed Deliciosa version, so administrators should consult ThemeRex (the theme vendor) and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/deliciosa/vulnerability/wordpress-deliciosa-theme-1-10-0-local-file-inclusion-vulnerability for an updated build and upgrade as soon as one above 1.10.0 is released. As compensating controls until a patch ships, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that blocks LFI patterns such as '../', null bytes, and PHP wrappers ('php://', 'file://', 'data://') on requests targeting theme paths under /wp-content/themes/deliciosa/, which may break legitimate template parameters and should be tested in monitor mode first. Where feasible, switch the site to a different theme until a fix is available, restrict open_basedir in php.ini to the WordPress root to limit reachable files (note: can break plugins that read outside webroot), and disable allow_url_include in PHP to reduce RFI escalation risk.