CVE-2025-69113
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in Nexio

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69113
EUVD
EUVD-2025-210194
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack nexio to 1.10.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The WordPress Nexio Theme, versions 1.10.0 and below, contains a Local File Inclusion (LFI) vulnerability. This flaw allows unauthenticated attackers to include local files from the target website's server. By exploiting this vulnerability, attackers can potentially access sensitive information such as database credentials.

Impact Analysis

Exploiting this vulnerability can lead to exposure of sensitive data, including database credentials. Depending on the server configuration, attackers might achieve a full database takeover. The vulnerability has a high severity score (8.1) and is likely to be targeted in mass-exploit campaigns, increasing the risk of compromise.

Detection Guidance

The vulnerability is a Local File Inclusion (LFI) in the WordPress Nexio Theme versions 1.10.0 and below, which allows attackers to include local files on the target website.

There is no specific detection command or method provided in the available resources.

Mitigation Strategies

Users are strongly advised to update the Nexio theme immediately to a version that is not vulnerable, if available.

Since there is no official patch available yet, Patchstack has issued a temporary mitigation rule to block attacks until an official fix is released.

It is recommended to seek assistance from your hosting provider or web developer to apply these mitigations and reduce the risk.

Compliance Impact

The Local File Inclusion vulnerability in the Nexio WordPress theme can lead to exposure of sensitive data such as database credentials and potentially a full database takeover. This exposure of sensitive information could result in non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access.

Because the vulnerability allows unauthenticated attackers to access local files, it increases the risk of data breaches, which are subject to regulatory reporting and penalties under these standards.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart