CVE-2025-49364
Published: 18 December 2025
Summary
CVE-2025-49364 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-49364 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Ludos Paradise WordPress theme developed by AncoraThemes. The issue impacts all versions from n/a through 2.1.3 and is associated with CWE-98. Published on 2025-12-18, it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
A network-based attacker requires no privileges or user interaction but must overcome high attack complexity to exploit the vulnerability remotely. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially enabling local file inclusion to disclose sensitive server files or, depending on configuration, achieve remote code execution.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/ludos-paradise/vulnerability/wordpress-ludos-paradise-theme-2-1-3-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion vulnerability in Ludos Paradise theme version 2.1.3, recommending mitigation through theme updates where available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-204239
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Ludos Paradise ludos-paradise allows PHP Local File Inclusion.This issue affects Ludos Paradise: from n/a through <= 2.1.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress theme enables exploitation of public-facing application (T1190) for remote disclosure of sensitive local files (T1005), with potential RCE depending on configuration.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of filename inputs to PHP include/require statements, preventing the improper control exploited in this LFI vulnerability.
Mandates timely identification, reporting, and correction of flaws, directly addressing the need to patch the vulnerable Ludos Paradise WordPress theme up to version 2.1.3.
Vulnerability scanning identifies LFI issues like CVE-2025-49364 in deployed WordPress themes, enabling remediation.