CVE-2025-49364: 
WordPress vulnerability analysis and mitigation

CVE-2025-49364 is a PHP Local File Inclusion (LFI) vulnerability in the AncoraThemes Ludos Paradise WordPress theme. It stems from improper control of filename for include/require statements (CWE-98), allowing unauthenticated remote attackers to include and potentially execute arbitrary local files on the server. All versions of the Ludos Paradise theme up to and including 2.1.3 are affected. The vulnerability was published on December 18, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is passed to a PHP include() or require() statement without adequate sanitization or whitelisting. This allows an attacker to manipulate the filename parameter to traverse the file system and include arbitrary local files. The attack vector is network-based, requires no authentication or user interaction, and has high attack complexity, suggesting some precondition (such as a specific server configuration or parameter exposure) must be met. No public proof-of-concept code has been confirmed at this time (Feedly, Patchstack).

Successful exploitation could allow an unauthenticated attacker to read sensitive server-side files (e.g., wp-config.php, /etc/passwd), potentially exposing database credentials and other secrets. In certain server configurations, LFI can be escalated to remote code execution by including log files or uploaded content containing PHP code. The vulnerability carries high confidentiality, integrity, and availability impacts per its CVSS score, meaning a successful attack could fully compromise the affected WordPress installation (Feedly).

There is no confirmed public proof-of-concept exploit or evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high attack complexity rating suggests exploitation is not trivial and may require specific conditions to be met (Feedly).

1. Reconnaissance: Identify WordPress sites using the Ludos Paradise theme version 2.1.3 or earlier using tools like WPScan, Shodan, or by inspecting theme metadata in publicly accessible style.css files.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate endpoints where user-controlled input is passed to a PHP include() or require() statement.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../wp-config.php or ../../../../etc/passwd) in the vulnerable parameter to attempt local file inclusion.
4. Extract sensitive data: If successful, the server response will contain the contents of the targeted file, potentially exposing database credentials, API keys, or system user information from wp-config.php or /etc/passwd.
5. Escalate to RCE (if applicable): In environments where PHP log poisoning or file upload is possible, inject PHP code into an accessible log file and then include it via the LFI vector to achieve remote code execution (Feedly).

• Network: Unusual HTTP GET or POST requests to theme-related endpoints containing path traversal sequences (e.g., ../, ..%2F, ....//) in query parameters or POST body.
• Logs: WordPress or web server access logs showing requests with encoded traversal strings targeting theme PHP files; repeated 200 responses to requests with suspicious file path parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files by the web server process.
• Process: Unusual PHP process activity or spawned child processes if LFI is escalated to code execution via log poisoning or uploaded file inclusion.

The primary remediation is to upgrade the Ludos Paradise WordPress theme to a version newer than 2.1.3. Until an update is available or applied, administrators should implement strict input validation for any file inclusion mechanisms, use whitelisting to restrict allowed file paths, and limit file system read permissions for the web server process. Disabling or removing the theme entirely until a patch is confirmed is also a viable interim measure. Regularly auditing installed themes and plugins for known vulnerabilities is recommended as a general best practice (Feedly, Patchstack).