CVE-2025-49361: 
WordPress vulnerability analysis and mitigation

CVE-2025-49361 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Mamita WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Mamita theme up to and including 1.0.9. The vulnerability was published on December 18, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements within the Mamita theme (CWE-98). An attacker can manipulate user-supplied input that is passed to a file inclusion function without adequate sanitization or whitelisting, allowing arbitrary local files on the server to be included and potentially executed. The attack vector is network-based, requires no privileges, but does require user interaction, with low attack complexity. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation could allow an attacker to read sensitive files on the server (e.g., WordPress wp-config.php, /etc/passwd, or other configuration files), access confidential data, or potentially include and execute malicious PHP code if file upload is also possible. The vulnerability has high confidentiality and high integrity impact with no availability impact, meaning attackers could exfiltrate credentials or modify application behavior. This could serve as a stepping stone for broader system compromise or lateral movement within the hosting environment (Feedly).

There is currently no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. CVE-2025-49361 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

The primary remediation is to update the Mamita WordPress theme to a version beyond 1.0.9 once a patched release is available from AncoraThemes. In the interim, administrators should implement strict server-side input validation for any file inclusion parameters, apply whitelisting to restrict allowable file paths, and enforce the principle of least privilege on the web server. A thorough security audit of the WordPress installation is also recommended to identify any signs of prior exploitation (Feedly, Patchstack).