Cyber Resilience

CVE-2025-49361

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0052 39.7th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-49361 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-49361 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that enables PHP Local File Inclusion in the AncoraThemes Mamita WordPress theme. This issue affects Mamita versions from n/a through 1.0.9. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.

The vulnerability can be exploited by unauthenticated attackers with network access, though it requires high attack complexity and no user interaction. Exploitation allows attackers to perform local file inclusion, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized access to sensitive files or system compromise on affected WordPress installations running the vulnerable theme.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/mamita/vulnerability/wordpress-mamita-theme-1-0-9-local-file-inclusion-vulnerability?_s_id=cve. The vulnerability was published on 2025-12-18.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mamita mamita allows PHP Local File Inclusion.This issue affects Mamita: from n/a through <= 1.0.9.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an improper filename control in a public-facing WordPress theme, enabling unauthenticated remote exploitation for local file inclusion and system compromise, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-60043Shared CWE-98
CVE-2026-22414Shared CWE-98
CVE-2025-69396Shared CWE-98
CVE-2026-22372Shared CWE-98
CVE-2025-67523Shared CWE-98
CVE-2025-53434Shared CWE-98
CVE-2026-27342Shared CWE-98
CVE-2026-22496Shared CWE-98
CVE-2025-49426Shared CWE-98
CVE-2025-49369Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Timely remediation of the known PHP Local File Inclusion flaw in Mamita theme versions <=1.0.9 directly prevents exploitation by applying patches from advisories like Patchstack.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes filenames used in PHP include/require statements to block malicious inputs enabling Local File Inclusion attacks.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Vulnerability scanning identifies the CVE-2025-49361 flaw in deployed WordPress themes, enabling proactive patching before exploitation.

References