CVE-2025-69145
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in Gat

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Gat <= 1.16 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69145
EUVD
EUVD-2025-210231
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack gat to 1.16 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2025-69145 is a Local File Inclusion (LFI) vulnerability found in the WordPress Gat Theme version 1.16 or lower. This flaw allows unauthenticated attackers to include local files on the target website.

By exploiting this vulnerability, attackers can potentially access sensitive data such as database credentials and may even achieve a full database takeover.

Impact Analysis

This vulnerability poses a high risk as it can lead to exposure of sensitive information and full database compromise without requiring authentication.

The CVSS score of 8.1 reflects the high severity and significant risk of exploitation, especially in mass campaigns targeting many websites.

If exploited, attackers could gain unauthorized access to critical data, disrupt website operations, and compromise the integrity and availability of your system.

Mitigation Strategies

The WordPress Gat Theme version 1.16 or lower is vulnerable to a high-priority Local File Inclusion (LFI) flaw with no official patch available yet.

Immediate mitigation steps include applying the temporary mitigation rule provided by Patchstack to block attacks until an official fix is released.

It is also advised to update the theme if an update becomes available, or seek assistance from a hosting provider or web developer to help secure the site.

Compliance Impact

The vulnerability allows unauthenticated attackers to include local files on the target website, potentially exposing sensitive data such as database credentials and enabling a full database takeover.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Therefore, organizations using the affected Gat theme versions may face increased risk of violating these standards if the vulnerability is exploited and sensitive data is compromised.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69145. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart