CVE-2025-69146
Deferred Deferred - Pending Action
Unauthenticated Local File Inclusion in Dom

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Patchstack

Description
Unauthenticated Local File Inclusion in Dom <= 1.24 versions.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-17
AI Q&A
2026-06-17
EPSS Evaluated
N/A
NVD
CVE-2025-69146
EUVD
EUVD-2025-210210
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
patchstack dom to 1.24 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The WordPress Dom Theme version 1.24 or earlier contains a Local File Inclusion (LFI) vulnerability. This flaw allows unauthenticated attackers to include local files on the target website.

Exploiting this vulnerability can expose sensitive data such as database credentials and may lead to a complete database takeover depending on the server configuration.

The vulnerability has a high severity score of 8.1 and is expected to be targeted in mass-exploit campaigns affecting many websites.

Impact Analysis

If exploited, this vulnerability can lead to exposure of sensitive information like database credentials.

It may also result in a complete takeover of the database, compromising the integrity, confidentiality, and availability of your website's data.

Such an attack can disrupt website operations and potentially cause significant damage depending on the server setup.

Mitigation Strategies

The WordPress Dom Theme version 1.24 or earlier is vulnerable to a high-priority Local File Inclusion (LFI) flaw with a CVSS score of 8.1.

As there is no official patch available from the theme developers yet, immediate mitigation steps include:

  • Applying the temporary mitigation rule issued by Patchstack to block attacks.
  • Updating the theme to a version later than 1.24 once available.
  • Seeking assistance from your hosting provider or a web developer to implement protective measures.
Compliance Impact

This Local File Inclusion (LFI) vulnerability in the WordPress Dom Theme versions 1.24 and earlier can lead to exposure of sensitive data such as database credentials and potentially a complete database takeover. Such data breaches can result in unauthorized access to personal and protected information.

Exposure of sensitive data due to this vulnerability could lead to non-compliance with data protection regulations and standards like GDPR and HIPAA, which require safeguarding personal and health information against unauthorized access and breaches.

Organizations using the affected theme should take immediate mitigation steps to prevent exploitation, as failure to do so may result in violations of these compliance requirements.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart