Theme-Rex vulnerabilities and threats

CVE-2025-69157 is a high-severity vulnerability in ThemeREX Gamic versions up to and including 1.15. It involves an unauthenticated Local File Inclusion (LFI) issue due to improper control of filenames used in include/require statements in PHP. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2025-69144 is a high-severity vulnerability in ThemeREX Preservation versions up to and including 1.10. It involves an unauthenticated local file inclusion (LFI) issue due to improper control of filenames in include/require statements in PHP. This vulnerability allows an attacker to include and execute arbitrary files on the server, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2025-69127 is a critical vulnerability in ThemeREX Plumbing versions up to and including 1.6. It involves unauthenticated PHP object injection due to deserialization of untrusted data, classified under CWE-502. This vulnerability allows an attacker to execute arbitrary code without any authentication. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

CVE-2025-69126 is a high-severity vulnerability affecting ThemeREX Fortius versions up to and including 2.3.0. It involves an unauthenticated Local File Inclusion (LFI) flaw due to improper control of filenames used in include/require statements in PHP, classified under CWE-98. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. Exploits in the wild are not known at this time.

CVE-2025-69123 is a high-severity vulnerability affecting ThemeREX Snow Club versions up to and including 1.1. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which allows improper control of filenames in include/require statements in PHP. This flaw could enable an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2025-69120 is a high-severity vulnerability in ThemeREX Dazzle versions up to and including 1.0.0. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements in PHP. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2025-69115 is a high-severity vulnerability in the ThemeREX LuxMed | Medicine & Healthcare Doctor WordPress Theme affecting versions up to and including 1.2.2. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which relates to improper control of filenames in include/require statements in PHP programs. This vulnerability allows an attacker to include local files on the server, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2025-69111 is a critical vulnerability in ThemeREX Reisen versions up to and including 1.4.1. It involves unauthenticated PHP object injection due to deserialization of untrusted data (CWE-502). This flaw allows remote attackers to execute arbitrary code without authentication, impacting confidentiality, integrity, and availability.

CVE-2025-69106 is a high-severity vulnerability in ThemeREX Imba versions up to and including 1.5.0. It allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This vulnerability could lead to full compromise of confidentiality, integrity, and availability of the affected system.

CVE-2026-22338 is a high-severity vulnerability in ThemeREX EcoBlue versions up to and including 1.15. It involves an unauthenticated Local File Inclusion (LFI) issue, classified under CWE-98, which allows improper control of filenames in include/require statements in PHP. This flaw can lead to remote file inclusion attacks, potentially resulting in full compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.

Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.

CVE-2025-69172 is a high-severity vulnerability affecting ThemeREX Resurs versions up to and including 1.3. It involves an unauthenticated Local File Inclusion (LFI) issue due to improper control of filenames used in include/require statements in PHP. This vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.

CVE-2025-69161 is a high-severity vulnerability in ThemeREX Snowy versions 1.13 and earlier that allows unauthenticated local file inclusion due to improper control of filenames in include/require statements. This vulnerability can lead to remote file inclusion attacks, potentially resulting in complete compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in Quirky <= 1.23 versions.

CVE-2025-69145 is a high-severity vulnerability affecting ThemeREX Gat versions up to and including 1.16. It involves an unauthenticated local file inclusion (LFI) flaw due to improper control of filenames in include/require statements in PHP code. This vulnerability can lead to remote file inclusion attacks, potentially allowing attackers to execute arbitrary code, compromise confidentiality, integrity, and availability of the affected system.

CVE-2025-69117 is a high-severity vulnerability in ThemeREX Ingenioso versions up to and including 1.14.0. It involves an unauthenticated Local File Inclusion (LFI) due to improper control of filenames in include/require statements in PHP, classified under CWE-98. This flaw allows an attacker to include local files on the server without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.

Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.

Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.