CVE Field Guide
About Us
CVE-2025-69107
PUBLISHED
WordPress Rosaleen theme <= 2.8 - Local File Inclusion vulnerability
Assigner:
Patchstack
Reserved:
29.12.2025
Published:
16.06.2026
Updated:
17.06.2026
Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.
Metrics
CVSS 3.1
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score:
8.1
CVSS score
8.1
Attack Vector
Network
Scope
Unchanged
Attack Complexity
High
Confidentiality Impact
High
Privileges Required
None
Integrity Impact
High
User Interaction
None
Availability Impact
High
CVSS 3.1
Product Status
Vendor
ThemeREX
Product
Rosaleen
Versions
Default:
unaffected
affected from n/a to 2.8 (incl.)
Credits
Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
finder
References
https://patchstack.com/database/wordpress/theme/rosaleen/vulnerability/wordpress-rosaleen-theme-2-8-local-file-inclusion-vulnerability?_s_id=cve
Problem Types
CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CWE
Impacts
CAPEC-252 PHP Local File Inclusion