What is the CVSS score of EUVD-2025-210234?

EUVD-2025-210234 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Orpheus WordPress Theme are affected by EUVD-2025-210234?

ThemeREX Orpheus WordPress theme versions 1.3 and earlier contain an unauthenticated remote file inclusion vulnerability (CVSS 8.1) that allows attackers to read arbitrary server files and…

How to fix or mitigate EUVD-2025-210234?

24 hours: Identify and audit all WordPress sites using ThemeREX Orpheus theme version 1.3 or earlier; immediately disable the theme. 7 days: Remove the vulnerable theme and deploy a patched alternative; implement Web Application Firewall (WAF) rules to block Local File Inclusion (LFI) exploitation attempts targeting known vulnerable paths. 30 days: Establish and enforce a policy restricting WordPress theme usage to vendors with documented security update procedures; deploy endpoint detection and response (EDR) to monitor for unauthorized file access patterns.

Orpheus WordPress Theme EUVD-2025-210234

| CVE-2025-69171 HIGH

PHP Remote File Inclusion (CWE-98)

2026-06-17 Patchstack

PHP Information Disclosure LFI Orpheus

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable PHP LFI (AV:N, PR:N, UI:N); AC:H reflects non-trivial path/bypass conditions; full CIA impact via wp-config disclosure and potential RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:39 vuln.today

DescriptionCVE.org

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

AnalysisAI

Unauthenticated Local File Inclusion in the ThemeREX Orpheus WordPress theme (versions <= 1.3) allows remote attackers to read arbitrary files on the server and potentially achieve code execution via PHP file inclusion. The flaw stems from improper control of filenames in an include/require statement (CWE-98), and while no public exploit has been identified at time of analysis, the CVSS 8.1 rating reflects high impact across confidentiality, integrity, and availability. Risk is somewhat tempered by the high attack complexity metric in the CVSS vector.

Technical ContextAI

Orpheus is a commercial WordPress theme distributed by ThemeREX (CPE: cpe:2.3:a:themerex:orpheus). The underlying weakness is CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), where user-controlled input is passed into a PHP include(), require(), include_once(), or require_once() call without proper sanitization or path validation. In WordPress theme contexts, this typically occurs in AJAX handlers, shortcode processors, or theme template loaders that accept a filename parameter from GET/POST data. Successful exploitation can disclose sensitive files such as wp-config.php (containing database credentials and secret keys) and, depending on PHP configuration and the inclusion context, can escalate to remote code execution by including attacker-controlled content (log poisoning, session files, uploaded media).

RemediationAI

Patch status: Patch available per vendor advisory - consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/orpheus/vulnerability/wordpress-orpheus-theme-1-3-local-file-inclusion-vulnerability) and upgrade Orpheus to a version newer than 1.3 if the vendor has published one; the exact fixed version is not stated in the available intelligence. If no upgrade is yet available from ThemeREX, compensating controls include deploying a WAF rule (Patchstack, Wordfence, or ModSecurity) to block requests containing path traversal sequences (../, %2e%2e%2f, php://, file://, data://) targeting Orpheus theme endpoints, restricting PHP's allow_url_include=Off and tightening open_basedir to the WordPress root (side effect: may break plugins that rely on absolute paths outside the site root), and disabling or restricting access to the vulnerable theme files via .htaccess until patched. As a last resort, switch to a different theme; note that deactivating the theme alone may not be sufficient if the vulnerable endpoint remains reachable through theme files on disk.